Claude Code Backdoor on the Cursor Marketplace: What Shop Owners Need to Know
By Arash Latifi — Founder, The DevArt
Versions 2.1.312 and 2.1.313 of the official Claude Code extension were backdoored on the Cursor Marketplace. The 5-second check, indicators of compromise, and the supply-chain lesson for small businesses.
TL;DR — Versions 2.1.312 and 2.1.313 of the official Claude Code VS Code extension on the Cursor Marketplace carried an SSH backdoor; run one
grepcommand to check, because uninstalling the extension does not remove it.
On October 29, 2026, for roughly 11 hours (2:27am–1:35pm PT), a maliciously modified version of Anthropic's Claude Code extension was available on the Cursor VS Code Extension Marketplace. Per Cursor's security notice, these versions "were not developed by Anthropic" and the injected code attempted to install a persistent SSH backdoor. If you run a store and a developer or contractor touches your panels, repos, or servers, this concerns you.
What happened
Per the official Cursor notice:
- Extension
Anthropic.claude-codeversions 2.1.312 and 2.1.313 (macOS and Windows) were compromised - Malicious code was injected into
extension.jsand ran on load — no user interaction needed - It appended an attacker-controlled SSH key (comment
svc-telemetry) to~/.ssh/authorized_keys - It opened a reverse SSH tunnel to
134.209.82[.]225and beacons host details (hostname, username, Git email, public IP, env-var names matching KEY/TOKEN/SECRET/PASS/AWS/GCP) - Cursor shut the whole marketplace down, rotated keys, rebuilt it, and took the attacker's server offline with the hosting provider
Per Phorion's technical analysis, the actual login likely failed on most machines: a bug in the malware's macOS check (systemsetup -getremotelogin without admin rights errors out and the script misreads it as "SSH already on") means SSH was usually never enabled. Cursor confirms the enablement step "would fail" without unusual privileges. The planted key and persistence, however, remained.
Why small businesses should care
Two reasons. First, the domino effect: if your developer or contractor's laptop ran the backdoored extension while it had access to your store panel, server, or repos, the attacker had a live channel into a machine inside your trust boundary. Second, supply-chain attacks scale: Wired reports the record $6.3B Binance hack (October 29, the largest crypto theft in history) began with "a compromised engineer's laptop". One tainted extension or one infected laptop is a realistic entry point — not a hypothetical.
Check your machines now
- [ ] Ran
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo FOUND || echo CLEAN(Cursor's own suggested check, macOS/Linux) - [ ] Confirmed
~/.config/.smtand~/.config/.smtkdo not exist (persistence scripts) - [ ] Confirmed
~/Library/LaunchAgents/com.apple.sysmond.plistdoes not exist (macOS persistence) - [ ] Confirmed no suspicious
@rebootcron entry (Linux) orSysMonscheduled task (Windows) - [ ] If any check flagged: ran Cursor's official
remediate-macos.sh/remediate-windows.ps1, removed the planted key, and rotated credentials from a trusted machine
If FOUND, do not stop at uninstalling the extension — Cursor's notice states plainly that "uninstalling the extension may not be sufficient."
Indicators at a glance
| Indicator | Where to look | Action |
| --- | --- | --- |
| SSH key svc-telemetry | ~/.ssh/authorized_keys | Remove + rotate credentials |
| Persistence files | ~/.config/.smt, .smtk, com.apple.sysmond.plist | Delete files and LaunchAgent |
| Network | Outbound to 134.209.82[.]225 (TCP 22, HTTP :8099/beacon) | Isolate host |
| Temp files | .stk_ + 10 hex chars | Delete |
| Real intrusion | SSH logins from 127.0.0.1 authenticated with the planted key | Treat as confirmed breach |
Takeaways for a small team
- Treat every extension your developer installs as trusted-employee-level access. Even official marketplaces get hit by supply-chain compromise.
- Uninstalling is not remediation. Competent malware drops persistence; always check the machine, not just the app list.
- Pre-decide your response. Cursor detected, shut down, rotated, and rebuilt within about a day. A one-page "if you see X, do Y" checklist beats improvising.
Q: We don't use Cursor or Claude Code — should we still check?
Yes, if anyone in your team or any contractor does. The backdoor lives on their machine, and that machine may hold credentials to your systems. One grep takes five seconds.
Q: I uninstalled the extension — am I safe?
No, not automatically. Per Cursor and Phorion, the payload drops standalone persistence scripts and an SSH key that survive the uninstall. Follow the checklist above.
Q: How do we prevent this next time?
Allow-list extensions, and alert on writes to ~/.ssh/authorized_keys on developer machines. No marketplace is 100% safe; internal controls are not optional.