The publisher name was right. The extension ID was right. The backdoor came in through the one part of the chain most of us never put on a risk register: the marketplace.

On 29 October, Cursor disclosed that maliciously modified builds of Anthropic’s Claude Code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, were available in the Cursor VS Code Extension Marketplace between about 2:27am and 1:35pm Pacific time. Anthropic did not build them. BleepingComputer puts the exposure at roughly 11 hours and up to 5,000 developers, and reports that researchers at Phorion and OpenSourceMalware found a JavaScript loader inserted at the start of extension.js that runs when the extension loads, without any interaction with Claude Code. Cyber Security News describes it as a 66-line loader sitting ahead of the legitimate code. Per Cursor, it reports hostname, username, Git email, public IP and environment-variable names, adds an attacker SSH key labelled svc-telemetry to authorized_keys, tries to enable SSH and open a reverse tunnel, and installs a LaunchAgent or scheduled task that retries the tunnel roughly every 60 seconds. On macOS that LaunchAgent is named com.apple.sysmond, and it is not an Apple component. Cursor pulled the version, shut the whole marketplace down, audited it, rotated keys, rebuilt it and had the attacker’s server taken offline. Cursor says it has no evidence that other versions of the extension, or the official distribution, are affected.

The comforting part is real but narrow. Enabling SSH needs admin rights the extension doesn’t have on most Macs and Windows machines, so on those hosts the tunnel failed and the attacker could not log in. But Cursor is explicit: the key, the persistence and the beacon still landed, and uninstalling the extension may not remove scripts that keep running on their own. A failed backdoor that left a key and a startup job behind is not a near miss. It’s an unfinished job.

The bigger lesson is about where we place trust. Most of us vet the publisher, then let the IDE fetch and auto-update whatever arrives under that name. Here the name was genuine and the distribution point was the weak link. AI coding assistants also sit on the machines that hold Git credentials, cloud tokens and source code, so a poisoned extension gets very close to what matters. For teams in Singapore, the exposure window ran from 5:27pm on 29 October to 4:35am on 30 October, overnight, when an auto-update would land without anyone looking.

What security leaders should do:

• Find every machine with Cursor that installed or updated Claude Code 2.1.312 or 2.1.313 during the window, and check authorized_keys for svc-telemetry.
• Where it’s found, isolate the host, remove the key, persistence and tunnel processes using Cursor’s indicators, and decide on a rebuild. Don’t treat an uninstall as cleanup.
• Rotate credentials and sessions reachable from affected hosts, from a clean device.
• Bring IDE extensions into your software inventory: approved lists, pinned versions, and alerts on new LaunchAgents, scheduled tasks and authorized_keys changes on developer endpoints.

A trusted publisher only helps if the shelf it sits on is trusted too.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #SupplyChainSecurity #DevSecOps #APAC #CyberSecurity

Sources: Cursor security notice · BleepingComputer · Cyber Security News