Malicious Claude Code Extension Found in Cursor Marketplace

Cursor resolved a security incident involving malicious distributions of the Anthropic.claude-code extension on its marketplace. According to cursor.com's report, unauthorized packages 2.1.312 and 2.1.313 for Windows and macOS were published between 2:27am PT and 1:35pm PT on October 29, 2026. The tampered packages were not developed by Anthropic, and the breach did not affect other marketplace extensions, Grok Bot, Grok, or SpaceXSI products.

This report details how the rogue extension functioned, the host telemetry gathered, the reverse SSH backdoor attempts, and complete recovery procedures. The guide is structured for developers and security teams running Cursor on macOS or Windows who need to audit endpoints, purge persistent scripts, and reinstall authentic development tools.

What shipped in Malicious Claude Code Extension Found

The compromised Anthropic.claude-code packages numbered 2.1.312 and 2.1.313 contained a modified extension.js payload designed for automated host reconnaissance. Upon installation, the extension collected target telemetry without requiring administrative rights, profiling the hostname, username, operating system, architecture, home directory path, configured Git email, and active working directories. It also captured environment variable names and performed public IP lookups via ifconfig.me and api.ipify.org. Extracted telemetry was transmitted to an external beacon at 134.209.82.225 on port 8099 with a fallback local POST loop to 127.0.0.1:8099.

Beyond reconnaissance, the extension attempted to configure a persistent reverse SSH tunnel targeting tunnel@134.209.82.225 over TCP port 22. It injected an attacker public key commented as svc-telemetry with fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk into authorized_keys files across affected machines. On macOS, persistence utilized LaunchAgent com.apple.sysmond, while Windows deployed scheduled task SysMon attempting SYSTEM privileges with fallback startup script sysmon.cmd. Because enabling the local SSH daemon requires administrator privileges, the tunnel failed on standard user sessions, preventing unauthorized remote logins through the tunnel on standard developer machines.

What improved in Malicious Claude Code Extension Found

Marketplace defenses and security baselines improved immediately once Cursor identified the unauthorized releases. Platform administrators removed versions 2.1.312 and 2.1.313, shut down the marketplace temporarily, audited all hosted packages, and confirmed no other extensions were altered. Cursor rotated internal keys, rebuilt the distribution infrastructure from clean sources, and partnered with the hosting provider to take the attacker server offline. Decommissioning 134.209.82.225 eliminated the telemetry beacon and blocked incoming reverse shell handshakes for all affected developer endpoints across both supported operating systems.

Endpoint remediation improved through automated cleanup scripts published by Cursor for affected environments. The standalone scripts remediate-macos.sh and remediate-windows.ps1 terminate background processes matching autossh or tunnel routines, remove malicious configuration files, and purge the svc-telemetry public key from authorized_keys. In an updated notice on October 30, 2026, at 11:30 am PT, Cursor published finalized package hash signatures for Darwin ARM64 and Win32 x64 distributions. These verification tools guarantee non-zero exit codes if orphaned cron entries or persistent scripts remain on the host environment.

What you gain from Malicious Claude Code Extension Found

Engineering teams gain concrete forensic signatures and established detection workflows to audit development workstations across their fleet. The incident highlights critical extension execution boundaries, demonstrating how standard operating system privilege controls successfully contained the threat. Because standard developer workstations do not run Cursor with root or administrator rights, automated attempts to execute systemsetup -setremotelogin on or register OpenSSH capabilities on Windows failed. While host details and the attacker SSH public key were written locally, the reverse shell was prevented from establishing an interactive session.

Security responders also gain clear verification procedures to validate endpoint safety and prioritize credential rotation. Administrators can inspect authorized_keys files directly for the svc-telemetry string to confirm infection status without running heavy scanning agents. In addition, confirmed exposure limits clarify actual risk. Because the payload gathered environment variable names rather than secret token values, teams can logically target credential rotation on high-value secrets, local private keys, and repository tokens associated with affected machines while verifying that background persistence has been completely neutralized.

How to get Malicious Claude Code Extension Found

To verify endpoint integrity, inspect authorized keys for the rogue public key before executing cleanup scripts. On macOS, run grep -qs svc-telemetry ~/.ssh/authorized_keys to identify the unauthorized key. On Windows PowerShell, evaluate authorized_keys paths across user and administrator profiles. If the svc-telemetry key is detected, execute bash remediate-macos.sh on macOS or run powershell -ExecutionPolicy Bypass -File .\remediate-windows.ps1 with administrator privileges on Windows. These automated cleanup scripts terminate running tunnel processes, delete dropped configuration files under ~/.config/.smt, and purge unauthorized keys.

npm install -g @anthropic-ai/claude-code
claude update
claude --model fable
claude config set model fable

/model claude-fable-5-1
/model fable

After removing rogue files, developers can install authentic Anthropic Claude Code tooling through legitimate package management channels. Install the verified package globally by running npm install -g @anthropic-ai/claude-code, or update an existing CLI installation using claude update. To start an interactive session pinned to a specific model architecture, launch the CLI using claude --model fable. Within an active session, switch models dynamically with /model claude-fable-5-1 or /model fable. To establish a permanent default model preference across all upcoming sessions, configure your global settings by running claude config set model fable.

What to watch after Malicious Claude Code Extension Found

Following remediation, system administrators must inspect target systems for dormant persistence scripts and recurring background tasks. On macOS machines, verify that ~/Library/LaunchAgents/com.apple.sysmond.plist is deleted and inspect temporary locations for lingering sockets formatted as stk with ten hexadecimal characters. Linux systems require checking crontabs for entries executing ~/.config/.smt or ~/.config/.smtk scripts. On Windows endpoints, verify that the SysMon scheduled task has been removed via schtasks, and inspect the user startup folder at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup to ensure sysmon.cmd is absent across all profiles.

Network monitoring teams should monitor outbound perimeter logs for recurring connection attempts to 134.209.82.225 across port 22 or port 8099. Even though the attacker hosting infrastructure is offline, ongoing retry attempts indicate an active background process executing tunnel loops every 60 seconds. Developers who executed versions 2.1.312 or 2.1.313 under administrator privileges must treat the host as compromised and conduct a complete operating system rebuild. In those instances, rotate all repository tokens, cloud credentials, and sessions from a trusted machine, directing any unresolved inquiries to security@cursor.com.