A trusted Claude Code extension shipped a backdoor. Here’s the five-minute check.

Most of us check a tool once, decide it’s safe, and then let it update itself forever. That second part is the gap this attack went through.

On 29 October, between 09:27 and 20:35 UTC, Cursor’s extension marketplace served a modified build of anthropic.claude-code. The name was right. The publisher looked right. A small loader had been added to the top of extension.js, and the rest of the file was untouched.

What it tried to do

The loader ran the moment the editor loaded the extension. According to StepSecurity’s analysis of the code, it:

• sent your hostname, username, public IP, git email and the names of environment variables that looked like secrets to a remote server
• added an attacker’s SSH key, labelled svc-telemetry, to ~/.ssh/authorized_keys
• tried to switch on SSH and open a reverse tunnel back to that server
• set itself up to come back after a reboot

Two details matter. StepSecurity found no code reading credential values, so this was about getting a way in, not grabbing keys on the spot. And it had bugs: the reports say the SSH step often failed on Windows and on many Macs. That’s luck, not safety. Whether anyone actually logged in to a machine is still unknown.

Were you exposed?

Probably not, if you don’t use Cursor. All three reports put the poisoned build on Cursor’s marketplace, and Microsoft’s marketplace wasn’t affected. Anthropic says its own distribution wasn’t compromised. The reports disagree on two points: whether 2.1.312 was bad as well as 2.1.313, and whether a bad build reached Open VSX. So treat both versions as suspect.

If you use Cursor, run these:

# Which version do you have?
cursor --list-extensions --show-versions | grep anthropic.claude-code

# Is the attacker's key there?
grep svc-telemetry ~/.ssh/authorized_keys

# Are the leftovers there?
ls -la ~/.config/.smt ~/.config/.smtk
ls ~/Library/LaunchAgents/com.apple.sysmond.plist   # macOS
crontab -l | grep @reboot                           # Linux

On Windows, run schtasks /query /tn SysMon, then look for sysmon.cmd in your Startup folder.

A version number alone doesn’t prove you were hit, and an empty result from these commands doesn’t prove you’re clean. Think of them as a quick first look.

If you find something

Take the machine off the network. Don’t just uninstall the extension, because the scripts it left behind keep running without it. From a different, trusted device, rotate every key and token that machine could reach and sign out of your active sessions. Then follow the removal steps in Cursor’s own notice. If you can rebuild from a known-good backup, that’s the option you can trust most.

The habit worth changing

You can’t personally audit every update, and pretending otherwise doesn’t help. But you can shrink the blast radius:

• Turn off extension auto-update on the machine that holds your production keys. In VS Code-style editors, the setting is "extensions.autoUpdate": false.
• Keep fewer extensions. Open your list today and remove anything you haven’t used this month.
• Keep real secrets out of your shell. The attacker’s first request listed the names of your environment variables. A secret manager gives that list much less to show.
• Check authorized_keys now and then. It’s a short file, and you should recognise every line in it.

The lesson here isn’t “don’t trust AI tools”. The trust just moved one level up, from the tool’s maker to the shop that hands it to you.