A tampered copy of the Claude Code extension sat in Cursor’s extension marketplace for about 11 hours on 29 October, and Microsoft Threat Intelligence has now published what the injected code tried to do on developer machines and what security teams should look for.
Microsoft’s analysis, posted on 31 October UTC, covers versions 2.1.312 and 2.1.313 of the anthropic.claude-code package. According to Microsoft, Cursor reported that the packages were live from about 2:27 a.m. to 1:35 p.m. Pacific time. Microsoft says the malicious packages were never published or distributed through the Visual Studio Marketplace or the npm package @anthropic-ai/claude-code, and that Anthropic confirmed its systems were not compromised and that it did not develop the package. Microsoft adds that “all evidence suggests that the incident is limited to Cursor marketplace.”
What the injected code attempted
Microsoft describes a loader that ran when the extension module loaded, before the extension’s normal code, while the extension kept working so users would see nothing wrong. The sequence it reconstructs has five stages: collecting host and user details, adding an attacker-controlled SSH key to the user’s authorized keys, trying to enable the local SSH service, opening an outbound reverse SSH tunnel back to the workstation, and writing startup entries so the tunnel would come back after a reboot. A delayed callback then tried to report the collected details.
Two points in Microsoft’s write-up set the scope. First, the reconnaissance gathered the names of environment variables matching terms such as KEY, TOKEN, SECRET, AWS or GCP, up to forty of them. Microsoft says the callback sent “matching environment-variable names, not values,” which reveals what kinds of secrets a machine holds without showing that the secrets themselves were taken. Second, a running tunnel process does not prove access. Cursor reports, as quoted by Microsoft, that errors and administrator-permission requirements blocked SSH access on most macOS and Windows hosts. Microsoft notes that the loader “may still write keys and persistence artifacts even when tunnel access fails.”
Cursor’s own security notice says it removed the versions, shut the marketplace down as a precaution, audited access, rotated its keys, rebuilt the marketplace and worked with the hosting provider to take the attacker’s server offline. It says it confirmed no other extensions were tampered with.
Why removing the extension is not the end of it
The persistence sits outside the extension’s folder. Microsoft lists a user LaunchAgent on macOS, a user crontab entry that runs at reboot on Linux, and on Windows an attempted scheduled task requesting SYSTEM rights with a batch file in the Startup folder as a fallback. The startup objects carry names that resemble monitoring components. Microsoft’s guidance is blunt on this point: “Removing or updating the extension does not remove artifacts written outside its installation directory.” It also says the reported takedown of the attacker’s server does not remove artifacts already on a device.
That changes the incident from a bad package to a host investigation. A machine that pulled the update during the window has to be treated as possibly backdoored until someone checks the SSH authorization files and the startup locations, even if the tunnel never connected.
What it means for the security leader
Developer workstations hold source code, cloud credentials, signing keys and session tokens, and their tooling updates itself. An editor extension runs with the developer’s own rights, so a single tampered release reaches every machine that auto-updates during the window. In our reading, the incident shows that extension marketplaces for AI coding tools now belong in the same software supply chain program as package registries, with the same controls: an allowlist of publishers, a delay before new versions install, and telemetry that records which version landed on which host and when.
Cursor’s security-hardening guidance, which Microsoft cites, covers two of those controls directly: restricting extensions to approved publishers and setting an installation cooldown so newly published versions wait before they install. Our opinion on setting package cooldowns longer than the one-day default makes the case that the delay has to outlast the time it takes a marketplace to spot and pull a bad release. Here the window was about 11 hours.
The incident also follows a run of AI tooling supply chain cases. Our analysis of how LiteLLM coverage moved from the malware to an unrevoked key found the lasting damage in credentials that outlived the cleanup, and our opinion on reading SSH access policy as a map of what one stolen device can reach applies directly to a backdoor built on SSH keys.
What to do now
Microsoft and Cursor give the same order of work. Defenders should:
- Identify every machine that installed or auto-updated to anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor marketplace on 29 October, using extension-installation records and endpoint telemetry.
- Preserve evidence first: the extension package, modified SSH authorization files, generated keys and scripts, and startup configuration.
- Check the user’s SSH authorized keys for the attacker key labeled svc-telemetry, confirm it against the published fingerprint, and remove only that entry.
- Inspect each startup object’s configured action before removing it, since Microsoft warns that names alone do not separate malicious objects from real monitoring software.
- Isolate hosts with evidence of execution, review telemetry for SSH key acceptance, tunnel processes and local SSH sessions, and rotate credentials and revoke sessions from a known-clean device where exposure is indicated.
Cursor has published platform-specific check and remediation scripts with its notice, and Microsoft has published Defender XDR detections and hunting queries with its analysis. Microsoft advises reviewing the scripts before running them. Neither company has reported how the tampered versions were placed in the marketplace.
