Cursor marketplace served a tampered Claude Code extension that dropped an SSH backdoor (up to ~5,000 users)

On Oct 29, a tampered build of Anthropic's Claude Code extension (v2.1.313) was served from Cursor's VS Code marketplace for ~11 hours. The injected payload appended an attacker Ed25519 key to ~/.ssh/authorized_keys, enabled OpenSSH, opened a reverse tunnel to 134.209.82[.]225, and installed macOS LaunchAgent / Windows SysMon persistence; a macOS privilege bug limited inbound access but the key, persistence and host reconnaissance beacon still ran. Cursor (SpaceX) pulled the package, shut the marketplace, and ships remediation scripts; up to ~5,000 users affected.

It is the first live supply-chain compromise of a widely adopted AI coding agent via an editor marketplace, proving agent extensions are a prime attack surface that bypasses traditional supply-chain controls and demands marketplace-level signing, scanning and IR runbooks.

Anyone running Claude Code for VS Code 2.1.313 (or Cursor extensions) should immediately scan for the 'svc-telemetry' key, dropped .smt artifacts and C2 connect; rotate credentials from a clean host and review editor-extension procurement/scanning policy.