I use Claude Code in VS Code or from npm. Should I worry?
Microsoft confirmed the malicious version never appeared on the official VS Code Marketplace or in the npm package Anthropic-ai/claude-code, and Anthropic says its official channels were unaffected.
The affected people installed or auto-updated to 2.1.312 or 2.1.313 from Cursor's marketplace during the roughly 12 hours on October 29.
Could the backdoor actually connect?
Enabling SSH needs admin rights, which the extension usually lacks, so Cursor judges the reverse tunnel likely failed on most hosts.
But the key and persistence files were still written, and the server being offline only means it cannot connect now, not that the host is clean.
Is uninstalling the extension enough?
No. Microsoft points out that files written outside the install directory are not removed, including the key in authorized_keys, the LaunchAgent, the Scheduled Task and the cron entry.
Cursor provides remediation scripts for macOS and Windows, but still advises weighing whether to rebuild the host.
Were the values of environment variables leaked?
Per The Hacker News's summary, the initial beacon sent only variable names, not values, and no follow-on payloads were observed.
But the names tell an attacker which cloud and API credentials your machine holds, so the conservative move is still to rotate credentials the affected host could reach.
On October 29, 2026, Cursor issued a security notice: versions 2.1.312 and 2.1.313 of the extension with ID Anthropic.claude-code, published on Cursor's extension marketplace, were tampered with and leave a persistent SSH backdoor on developer machines. Cursor stresses that these versions were not developed by Anthropic. What follows relies on Cursor's notice and The Hacker News's summary.
Per Cursor's notice, the malicious versions could be installed from about 2:27 a.m. to 1:35 p.m. Pacific on October 29, roughly 12 hours, on Windows and macOS. Cursor updated the indicators of compromise and clarified the affected versions on October 30. The Hacker News cites Cursor as saying at most 5,000 users were affected; the notice page itself gives no count. How the attacker gained the ability to publish is unknown. Anthropic says its own systems and employee laptops were not compromised, and Cursor says the attacker used access to Cursor's marketplace to publish the tampered version.
The malware inserts a loader of about 66 lines ahead of the main JavaScript file, triggered when VS Code starts and when the extension's webview opens. It collects hostname, username, OS, architecture, home and working directories, the Git email and public IP, plus up to 40 environment variable names containing KEY, Token, SECRET, PASS, AWS or GCP (names only, no values), and sends them over unencrypted HTTP to an attacker server. It also tries to write an attacker SSH public key labeled svc-telemetry into authorized_keys, enable the local SSH service and open a reverse tunnel, with persistence through a macOS LaunchAgent, a Windows Scheduled Task or a Linux cron entry. Enabling SSH needs admin rights, which the extension usually lacks, so Cursor judges the tunnel likely failed on most hosts, but the key and persistence files were still written. No follow-on payloads have been observed.
The Cursor marketplace is the only confirmed distribution channel. Microsoft confirmed the malicious version never appeared on the official VS Code Marketplace or in the npm package anthropic-ai/claude-code, and Anthropic says its official channels were unaffected. On Open VSX, Socket found no evidence that 2.1.313 was ever listed, and earlier reports saying Open VSX was compromised were later corrected. The fixed version is 2.1.314, available on Open VSX and the VS Code Marketplace. Cursor removed the malicious versions, temporarily shut down the whole marketplace, rotated keys and rebuilt it, worked with the hosting provider to take the attacker's server offline, and says it will contact affected users directly.
The most direct check is whether ~/.ssh/authorized_keys contains a key labeled svc-telemetry; if so, treat the machine as affected. Other indicators include traffic to 134[.]209[.]82[.]225 (a beacon on port 8099 and reverse SSH on TCP 22), the macOS file com.apple.sysmond.plist and a Windows scheduled task named SysMon. Microsoft notes that uninstalling the extension does not remove files written outside its install directory, so the key, tunnel processes and startup entries have to be cleaned up separately.
If you or your team updated the Claude Code extension in Cursor on October 29, check for that key label now; if you find it, isolate the machine and rotate the credentials and sessions it could reach, since rebuilding a host usually costs far less than a leaked key. Two habits are worth adopting from here: switch extension auto-update to review-then-upgrade, and confirm Claude Code is installed from an official channel. This incident shows the attack surface was the marketplace you trust, not the model itself.