What Happened
Tampered versions 2.1.312 and 2.1.313 of the Claude Code-branded anthropic.claude-code extension were served through the Cursor Extension Marketplace on October 29, 2026, from approximately 2:27 AM to 1:35 PM PDT. Available evidence points to that marketplace alone; the Microsoft Visual Studio Marketplace, npm, and Anthropic systems were not affected [1].
The injected JavaScript gathered host details and the names, not values, of up to 40 matching environment variables. It attempted to install an SSH key labeled svc-telemetry, enable SSH, open a reverse tunnel to the workstation’s SSH service, and report host details. A tunnel alone does not establish that an attacker logged in; the outcome depended on host and server configuration [1].
Why It Matters to Businesses
Developer extensions run on machines that may have access to source code, cloud environments, and production tooling. In this case, removing the extension might not remove the intrusion: the loader could create a macOS LaunchAgent, Linux cron entry, or Windows scheduled task or Startup-folder entry outside the extension directory [1]. Incident response must therefore assess the endpoint, not just the marketplace package.
Kimbodo Engineering Perspective
We would treat an affected installation as a reason to investigate, not as proof of attacker access. The key distinction is between attempted persistence, an established tunnel, an accepted SSH key, and an authenticated session followed by commands or file activity. Keeping those findings separate avoids both premature reassurance and unnecessary fleet-wide rebuilds [1].
For prevention, publisher allowlists and an installation cooldown are practical controls, but they trade developer convenience for time to inspect newly released extensions. Neither replaces endpoint telemetry or a way to revoke device and credential trust [1].
How We Would Implement It
- Inventory Cursor installations and extension versions; preserve affected hosts and relevant endpoint and network evidence before cleanup [1].
- Hunt for the svc-telemetry key, generated .smt/smt.cmd scripts and .smtk identities, platform startup entries, SSH activity, and connections to 134.209.82[.]225. The published JavaScript entry-point SHA-256 is ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15; it is not a VSIX hash [1].
- Correlate detections with SSH key acceptance, tunnel activity, local sessions, commands, and file access. Remove confirmed malicious keys, processes, files, and startup entries; then verify they do not return [1].
Risks, Costs and Security
Hunt matches are leads, not proof of compromise, and limited telemetry may leave uncertainty about what an attacker did. Where credentials were exposed or device trust cannot be restored, rotate credentials and revoke sessions from a clean device; rebuild the workstation when necessary. The cost is investigation and developer downtime, but simply uninstalling the extension risks leaving a working backdoor behind [1].
Where Kimbodo Comes In
Kimbodo builds and operates this in production for businesses — see our AI Security & Guardrails practice, or Request a Security Review.
