What the tampered update tried to do

Cursor, the coding-tool company, has warned that a tampered version of Anthropic's Claude Code extension was distributed through its own extension marketplace, potentially affecting up to 5,000 users. The company said the malicious package was live for about eleven hours on Thursday 29 October, from around 2:27 a.m. to 1:35 p.m. Pacific Time, before it was removed.

The package carried the legitimate extension identity, anthropic.claude-code version 2.1.313, rather than appearing as a separate fake add-on. Researchers at OpenSourceMalware found a 66-line loader inserted ahead of the genuine code. Once the editor started, that loader tried to collect host details such as hostname, username, operating system and public IP address, and to add an attacker-controlled SSH key so an attacker could later log in remotely.

Cursor said a key step in that remote-access attempt would have failed on most machines because it needs administrator rights, but users who installed the affected version should not rely on that alone.

What users should do now

Cursor temporarily shut its marketplace, removed the package, rotated keys, rebuilt the service and brought it back online. It stressed the modified version “was not developed by Anthropic” and did not affect other extensions on its marketplace.

Users are asked to update to Claude Code for VS Code version 2.1.314 and to check for an unauthorised SSH key labelled “svc-telemetry” in their authorised-keys file. Any unfamiliar key, startup item or tunnel should be removed from a clean system, and credentials reachable from an affected machine should be rotated. The incident is a reminder that even a trusted update channel can carry a malicious build, so version numbers and publisher identity deserve a second look.

Sources: Reuters