Cursor has disclosed a supply chain incident after a maliciously modified build of Anthropic's Claude Code extension was distributed through its Cursor VS Code extension marketplace. The tampered package shipped under Anthropic's legitimate Claude Code identity as version 2.1.313, and was reachable for roughly eleven hours, between about 2:27am and 1:35pm PT on October 29, 2026. Cursor estimates that at most 5,000 users installed it.
Researchers at Phorion found a loader prepended to the extension's extension.js bundle. It runs as soon as the editor loads the extension, so no click was required. The injected code appends an attacker-controlled Ed25519 key labelled svc-telemetry to ~/.ssh/authorized_keys, tries to enable local SSH and open a reverse tunnel to an attacker server, installs persistence through a macOS LaunchAgent, a Linux cron entry or a Windows scheduled task, and beacons host details including hostname, username, Git email and the names of environment variables that look like secrets. The SSH path is buggy, which Cursor says makes remote access fail on most machines, but the malicious code still ran and phoned home.
Cursor removed the package, shut down and rebuilt its marketplace, rotated access keys and had the attacker's server taken offline. Anthropic says its own channels were not compromised and has shipped clean version 2.1.314. Uninstalling the extension is not a complete fix: check ~/.ssh/authorized_keys for a key labelled svc-telemetry, look for a LaunchAgent named com.apple.sysmond on macOS or the matching Windows scheduled task, remove the persistence files under ~/.config/.smt, and rotate credentials from a clean machine. For founders running small teams, auto-updating developer tooling is a supply chain surface worth reviewing now.