The backdoored Claude Code 2.1.313 build in Cursor's marketplace, explained

Cursor disclosed that a modified, malicious release of the Anthropic Claude Code extension, marked as version 2.1.313, was distributed directly through Cursor's extension marketplace on October 29, 2026. According to theainewsreport.com's report, the unauthorized build remained accessible for approximately 11 hours between 09:27 and 20:35 UTC, reaching an estimated maximum of 5,000 developers before being removed. Cursor confirmed that Anthropic did not author the build, and Cursor subsequently shut down its marketplace, audited access logs, rotated keys, and worked with the remote hosting provider to take down the attacker command server.

This teardown examines the exact mechanics of the planted backdoor loader, its operational footprint across Linux, macOS, and Windows workstations, and the containment steps required for developer teams. Engineering leads and security teams evaluating workstation integrity can follow the indicators, registry verification gaps, and remediation measures outlined below to assess whether developer machines running AI coding tooling were exposed to unauthorized persistence mechanisms or telemetry extraction during the incident window.

What shipped in Backdoored Claude Code 2.1.313 build

The unauthorized package shipped with a 66-line malicious loader prepended to extension.js, bearing a SHA-256 file hash of ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15. This script executes immediately when the editor loads the extension file, operating automatically prior to any Claude conversation or user prompt. The loader appends an attacker Ed25519 public key labeled svc-telemetry directly to the user authorized_keys file, attempting to grant persistent remote shell access to anyone possessing the matching private key.

Once the key is staged, the payload attempts to enable local SSH services using systemsetup on macOS, systemctl on Linux, or PowerShell on Windows. It establishes an outbound SSH connection to remote host 134.209.82.225 under user tunnel, requesting a reverse tunnel back to local port 22 and retrying every 60 seconds to bypass inbound firewalls. The loader also issues an unencrypted HTTP JSON payload over port 8099 reporting host data, including username, hostname, operating system, home folder, global Git email, public IP, and up to 40 variable names matching patterns like KEY, TOKEN, SECRET, PASS, AWS, or GCP.

What improved in Backdoored Claude Code 2.1.313 build

Public registry coordination improved immediately following the discovery, as Anthropic jumped directly over the compromised version number to ship clean 2.1.314 releases across verified distribution points. Open VSX, Microsoft Visual Studio Marketplace, and npm all omit version 2.1.313, moving cleanly from 2.1.312 up to official 2.1.314 artifacts published between 00:12 and 01:20 UTC on October 30, 2026. This deliberate version gap provides automated systems and security auditors a clear indicator of whether any workstation installation originated outside legitimate channels.

The release jump established unambiguous boundary conditions across registries, enabling rapid detection. If an audit reveals an active installation of anthropic.claude-code matching 2.1.313, administrators can confirm without ambiguity that the artifact did not originate from official public index snapshots.

What you gain from Backdoored Claude Code 2.1.313 build

Auditing affected workstations provides infrastructure teams with full visibility into the persistence mechanisms installed outside the extension sandbox. On macOS, the payload creates a LaunchAgent plist named com.apple.sysmond.plist alongside hidden marker files in ~/.config/.smt, ~/.config/.smtk, and temporary files matching $TMPDIR/.stk_*. On Linux systems, it drops an @reboot cron task invoking a hidden script, while Windows hosts receive a SYSTEM scheduled task named SysMon, a sysmon.cmd script in the user Startup folder, and ~/.config/smt.cmd.

Because these persistence artifacts live outside the editor extension folder, uninstalling the extension inside Cursor leaves the backdoor components operational. Systems where SSH was disabled generally blocked the reverse tunnel because the loader lacked administrative privileges to enable services, and Phorion noted a bug in the macOS path where systemsetup exited on error rather than enabling Remote Login. However, developer machines where SSH was already active must be treated as compromised, requiring credential rotation from a separate, uncompromised system.

How to get Backdoored Claude Code 2.1.313 build

Developers must replace any unverified builds by fetching authentic releases directly through official package managers, pinning authorized models, and updating default configuration flags. To install or update the clean Anthropic package across system environments, run the standard package manager update command:

npm install -g @anthropic-ai/claude-code

To update an existing installation using the built-in vendor mechanism, execute:

claude update

Within an active interactive session, developers can switch execution to the designated model directly using:

/model claude-fable-5-1

Alternatively, operators can launch pinned command-line sessions specifying the target model directly:

claude --model fable

To establish a persistent default across terminal invocations without passing manual flags, set the default model parameter:

claude config set --global model claude-fable-5-1

What to watch after Backdoored Claude Code 2.1.313 build

Workstations require immediate local scanning to verify whether persistence files or rogue authorized keys remain present. Operators can search for the injected public key by executing grep -qs svc-telemetry ~/.ssh/authorized_keys in terminal sessions. Windows administrators must inspect both $HOME\.ssh\authorized_keys and C:\ProgramData\ssh\administrators_authorized_keys for the svc-telemetry tag, while checking scheduled tasks for entries named SysMon.

Remediation requires running Cursor official cleanup scripts, executing remediate-macos.sh under standard user permissions or remediate-windows.ps1 in an elevated PowerShell prompt. Teams must also inspect perimeter and local network logs for historical connections to IP address 134.209.82.225 over port 22 or port 8099. Because telemetry packets transmitted environment variable names matching AWS, GCP, KEY, TOKEN, SECRET, or PASS, teams must rotate all corresponding operational secrets from known clean hardware.