Malicious Claude Code Extension Found on Cursor

A malicious extension impersonating Anthropic’s Claude Code circulated on Cursor’s VS Code extension marketplace, potentially affecting up to 5,000 users. Cursor said on the 30th local time that the altered extension had been listed the previous day and remained exposed for about 11 hours, from 2:27 a.m. to 1:35 p.m. on the 29th. It was not an official extension developed by Anthropic.

The extension attempted to collect system information, including host names, user names, operating systems and public IP addresses. The attacker also tried to gain remote access by running a backdoor script and forcibly adding a designated SSH public key, “svc-telemetry,” to systems to maintain access. An SSH public key is a cryptographic key used to verify a user or system in a secure connection.

Most attempts failed because the key steps for remote access required administrator privileges. Cursor said the likelihood of actual system takeover or serious harm was therefore limited. After finding the malicious version, Cursor removed it from the marketplace, blocked further distribution and temporarily suspended marketplace operations as a precaution. The marketplace returned online after related systems were rebuilt.

Security professionals warned that deleting the extension alone does not confirm a system is safe; users should check for and remove unauthorized SSH keys or leftover backdoor files. Cursor said the incident did not affect other marketplace extensions. The report also cautioned that altered software distributed under an official product name can be difficult to distinguish from legitimate tools, and advised users to check an extension’s source and publisher.

A malicious extension impersonating Anthropic’s Claude Code circulated on Cursor’s VS Code extension marketplace, potentially affecting up to 5,000 users. Cursor said on the 30th local time that the altered extension had been listed the previous day and remained exposed for about 11 hours, from 2:27 a.m. to 1:35 p.m. on the 29th. It was not an official extension developed by Anthropic.

The extension attempted to collect system information, including host names, user names, operating systems and public IP addresses. The attacker also tried to gain remote access by running a backdoor script and forcibly adding a designated SSH public key, “svc-telemetry,” to systems to maintain access. An SSH public key is a cryptographic key used to verify a user or system in a secure connection.

Most attempts failed because the key steps for remote access required administrator privileges. Cursor said the likelihood of actual system takeover or serious harm was therefore limited. After finding the malicious version, Cursor removed it from the marketplace, blocked further distribution and temporarily suspended marketplace operations as a precaution. The marketplace returned online after related systems were rebuilt.

Security professionals warned that deleting the extension alone does not confirm a system is safe; users should check for and remove unauthorized SSH keys or leftover backdoor files. Cursor said the incident did not affect other marketplace extensions. The report also cautioned that altered software distributed under an official product name can be difficult to distinguish from legitimate tools, and advised users to check an extension’s source and publisher.