Claude Code extension on Cursor was backdoored: how to check your PC for svc-telemetry
A tampered Claude Code extension sat on Cursor's marketplace for 11 hours and reached up to 5,000 users. How to tell if your laptop was hit, and what to do.
A tampered copy of the Claude Code extension was offered to Cursor users for about 11 hours on Thursday, 29 October, and it quietly tried to plant an SSH backdoor on their computers. Cursor, the AI code editor, says at most 5,000 people installed it and that it will contact them directly.
If you code in Cursor and use Claude Code, check your machine today. The fix takes ten minutes; ignoring it could hand a stranger a key to your laptop.
What happened
Version 2.1.313 of the Anthropic.claude-code extension appeared in Cursor’s extension marketplace between about 2:27 AM and 1:35 PM US Pacific time on 29 October, which is roughly 2:27 PM on Thursday to 1:35 AM on Friday in Pakistan. Cursor said plainly that “this malicious version of the extension was not developed by Anthropic”. The clean version, 2.1.314, is now out, and Cursor says it has no evidence that other versions, or the copies on Microsoft’s VS Code Marketplace and Open VSX, were affected.
Neither company has said how the attacker got the fake version onto the marketplace. Cursor says it has rotated its keys, rebuilt the marketplace and found no other tampered extensions.
What the fake extension did
A short piece of extra code was slipped in ahead of the real extension. Once it ran, it:
- collected details about the computer: hostname, username, operating system, home folder, Git email, public IP and the names (not values) of environment variables
- added an attacker’s SSH key, labelled
svc-telemetry, to your list of allowed keys - tried to switch on SSH and open a reverse tunnel to a server at 134.209.82.225
- set up a hidden task that retries every minute or so, even after a restart
There is some good news. Turning SSH on needs administrator rights, which the extension did not have on most Mac and Windows laptops, so on many machines the tunnel never opened. But the key and the hidden task were still installed, and Cursor says the attacker’s server is now offline.
How to check if you were affected
- Open your SSH keys file:
~/.ssh/authorized_keyson Mac or Linux, or%USERPROFILE%\.ssh\authorized_keysandC:\ProgramData\ssh\administrators_authorized_keyson Windows. - Search for svc-telemetry. If it is there, you were hit.
- Look in your extensions folder for
anthropic.claude-code-2.1.313. - On Windows, look for a scheduled task called SysMon; on Mac, a file named
com.apple.sysmond.plistin~/Library/LaunchAgents.
What to do if you find it
Uninstalling the extension is not enough, Cursor warns, because the hidden scripts keep running. Run the cleanup scripts Cursor has published for Mac and Windows, update to 2.1.314, and from a different, clean device change every password, token and API key that laptop could reach: GitHub, cloud accounts, client servers.
Why Pakistani freelancers should care
Thousands of Pakistani developers work for foreign clients from one laptop that holds those clients’ code and server keys. A backdoor on that machine is not only your problem; it can become your client’s breach and cost you the contract. Turn off automatic extension updates for tools that touch client work, and check new versions before they install.
The bigger lesson is about AI coding tools in general: they get deep access to your files and terminal, which makes their extensions a prize target. Expect marketplaces to add stricter checks after this one.
