Backdoored Claude Code extensions 2.1.312 and 2.1.313 reached Cursor users. How to check

What happened on October 29

For about 11 hours on October 29, 2026, Cursor’s extension marketplace offered tampered copies of Anthropic’s Claude Code extension. Cursor’s security notice now names two versions, Anthropic.claude-code 2.1.312 and 2.1.313 for Windows and macOS, available “between about 2:27am PT and 1:35pm PT.” The extension “runs malicious code that attempts to install a persistent SSH backdoor,” and Cursor says “at most 5,000 users were affected.”

The notice first named only 2.1.313, and so did this memo. An update dated 11:30 a.m. Pacific on October 30 says Cursor “updated the IOCs and clarified affected versions,” and Phorion, which found the backdoor, revised its advisory on October 31 to match.

Cursor pulled the versions, shut its whole extension marketplace down for a while, rotated its keys, rebuilt the marketplace and checked that no other extension had been changed. It also had the attacker’s server taken down: “The attacker server no longer functions.” Cursor says the incident “does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.”

The alarm went up publicly early on October 30, when the researcher Kevin Beaumont posted that the Claude Code extension “on Cursor has malware in it, which creates a remote access Trojan to desktops,” pointing to Phorion’s analysis. Anthropic published version 2.1.314 to npm, Open VSX and Microsoft’s Visual Studio Marketplace on the evening of October 29, Central Time, and 2.1.316 to npm and Open VSX on the evening of October 30. Microsoft’s marketplace still lists 2.1.314 as its newest on October 31.

What Anthropic says

Anthropic answered on October 30. Felix Rieseberg, of its technical staff, wrote: “We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.”

On Hacker News, David Dworken of Anthropic added that “2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts,” that “In order to disambiguate, we made sure our next update was 2.1.314,” and that “We have confirmed that no Anthropic systems or employee devices are involved in this.” He called Cursor’s “a third-party marketplace that we are not involved in owning, maintaining, deploying, or reviewing.”

That answers, from Anthropic’s side, the question this memo left open on October 30. Beaumont’s early posts said Anthropic “won’t comment,” and his DoublePulsar post is headlined “Anthropic hacked via Cursor to deliver remote access trojan to Claude developer laptops worldwide.” What nobody has explained is how the attacker got access to Cursor’s marketplace. The Register reports that, beyond Rieseberg’s statement, “neither Cursor nor Anthropic have commented on how the malicious package made its way to the official marketplace,” and Cursor’s notice still doesn’t say.

What the backdoor does

According to Phorion, code was added to the top of the extension’s extension.js (66 lines, by The Hacker News’s count), so it runs as soon as the editor loads the extension, before you ever open Claude. It tries to:

1. Add the attacker’s SSH key to ~/.ssh/authorized_keys, with the comment svc-telemetry.
2. Turn on SSH and open a reverse SSH tunnel to 134.209.82.225, which would let the attacker log in to your machine through it. A background loop retries every 60 seconds.
3. Stay on the machine: a LaunchAgent named com.apple.sysmond on macOS, a scheduled task named SysMon plus a Startup-folder script on Windows, and an @reboot cron entry on Linux.
4. Report the machine: hostname, username, operating system, home folder, working folders, Git email, public IP, and the names (not the values) of up to 40 environment variables matching words like KEY, TOKEN and SECRET.

There’s a mitigating bug. Cursor’s updated notice says that “Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail,” so on most Macs and Windows PCs “the attacker could not have logged in through the tunnel.” The key, the persistence and the report still happen. Phorion warns that if you turn on Remote Login later, the planted key works, and that on Linux a bug in the payload’s crontab check “can wipe existing user cron jobs on repeat runs.”

Who’s affected, and who isn’t

Where you got the extension	Affected?
Cursor’s marketplace, on a Mac or Windows PC, October 29, 2:27 a.m.–1:35 p.m. PT	Yes: tampered 2.1.312 and 2.1.313
Cursor’s marketplace, any other version	No evidence of it, Cursor says
Microsoft’s Visual Studio Marketplace (VS Code)	No: its 2.1.312 is Anthropic’s, and it never had 2.1.313
Open VSX	No: Anthropic says it never had 2.1.313
The Claude Code CLI on npm	No: npm lists 2.1.312, then 2.1.314
Claude Code in the terminal, Claude Desktop or the web	No: “only impacts Cursor users,” Anthropic says

The two 2.1.312s are the trap: the same number, different files. Cursor publishes hashes for its tampered 2.1.312 builds, while StepSecurity downloaded the 2.1.312 and 2.1.314 builds from Open VSX and “verified both contain none of the indicators.” The version number alone doesn’t tell you whether you’re affected; where the extension came from does.

Cursor’s list covers builds for Apple-silicon Macs and 64-bit Windows. The payload has Linux persistence too, by Phorion’s analysis and Cursor’s own indicators, so run the check below on any machine where Cursor installed the extension that day. Early reports also named Open VSX and npm; OpenSourceMalware and The Hacker News have since corrected that to the Cursor Marketplace.

How to check your machine

Cursor’s test looks for the planted key. On macOS (it works the same on Linux):

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, in PowerShell:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

On a Mac, a second sign is the backdoor’s LaunchAgent, named to look like Apple’s: ls ~/Library/LaunchAgents/com.apple.sysmond.plist should report no such file. Checking the extension’s version isn’t enough on its own, because it has likely auto-updated since, and 2.1.312 comes in a clean and a tampered form. Phorion lists the folders the tampered builds unpack into, such as anthropic.claude-code-2.1.312-darwin-arm64 and anthropic.claude-code-2.1.313-darwin-arm64, in the editor’s extensions folder.

What to do if you’re affected

1. Run Cursor’s remediation script. Download remediate-macos.sh and run it as yourself, not as root, or remediate-windows.ps1 from an administrator PowerShell. Cursor says they remove the extension, the persistence, the tunnel processes and the key, and exit with an error if anything remains.
2. Don’t rely on the update or an uninstall. “Uninstalling the extension may not be sufficient,” Cursor says, and Beaumont confirmed that the replacement versions do “not remove the prior backdoors and recon activity.”
3. Rotate what the machine could reach, from another, trusted computer: cloud and API keys, GitHub tokens, and your agents’ logins. Sign out of every session at the company, not just on the laptop.
4. At work, tell your security team. Cursor recommends isolating affected machines and deciding whether to rebuild them. Phorion and Cursor publish the file hashes and indicators to search for.

Is it connected to the Binance theft?

On the same day, October 29, about $6.3 billion left Binance’s wallets, by Binance’s estimate, most of it in about 20 minutes starting at 20:05 UTC, according to TRM Labs. Binance’s first explanation pointed at a developer’s machine: Elliptic quotes it as saying the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” On October 30, Beaumont posted: “I’ve confirmed Binance use Claude Code on Cursor with this extension.”

That’s as far as the evidence goes:

• Binance hasn’t named a cause. Its October 30 update says the laptop came from its “initial investigation,” and that “our subsequent investigation has uncovered additional points of breach. This was a complex attack.”
• No one has linked the two. Binance, Cursor and Anthropic haven’t connected the theft to the extension, and neither TRM’s analysis nor Elliptic’s mentions it.
• The timing doesn’t line up neatly. TRM says “Preparation began at least 36 hours before the theft,” with withdrawals to the attacker’s wallet “starting the morning of October 28,” about a day before the tampered builds appeared in Cursor’s marketplace. And on most machines, Cursor says, the tunnel couldn’t have let anyone in. Neither rules the extension out, but nothing published so far points to it.
• TRM attributes the theft to North Korea’s TraderTraitor group, a judgment it makes “with high confidence.” Elliptic calls that likely and notes that “No government has yet confirmed attribution.”

What hasn’t been said

• How the attacker got access to Cursor’s marketplace. Neither Cursor nor Anthropic has explained it.
• Whether anyone was logged in to through the tunnel, on the few machines where turning on SSH could have worked.
• What Binance’s “additional points of breach” are. Binance says it will “share more directly as we have them.”

We’ll update this memo when Cursor explains how the tampered builds got into its marketplace.