Backdoored Claude Code 2.1.313 reached up to 5,000 Cursor users; Anthropic's own registries show no trace of it

For about eleven hours on October 29, anyone who installed or auto-updated Anthropic's Claude Code extension inside Cursor could have received a version that quietly added an attacker's SSH key to their machine. Cursor says a modified Anthropic.claude-code 2.1.313 was available in its own VS Code extension marketplace from about 2:27am to 1:35pm PT (09:27 to 20:35 UTC), and that at most 5,000 users were affected.

The first reports put the problem somewhere much bigger. By Friday morning the story circulating on X, Mastodon and Hacker News was that Anthropic itself had been hacked and that the official extension, with tens of millions of installs, had shipped a remote access trojan. The registry records don't support that version of events, at least not so far.

Where 2.1.313 was, and wasn't

Anthropic publishes Claude Code to three public places: npm, Microsoft's VS Code Marketplace and Open VSX, the open registry that VS Code forks such as VSCodium use. None of them lists a 2.1.313 today:

• On npm, @anthropic-ai/claude-code goes from 2.1.312 (October 27) straight to 2.1.314 (October 30, 00:12 UTC). Neither the current version list nor the publication-time record has an entry for 2.1.313.
• The VS Code Marketplace lists 2.1.312 and then 2.1.314, published at 01:20 UTC on October 30.
• Open VSX shows the same gap. Socket, which ingests all three registries, checked Open VSX's append-only change feed from October 27 to October 30, 05:35 UTC, and found publication events for all eight platform builds of 2.1.312 and 2.1.314, and none for 2.1.313, not even a removal.
• Claude Code's own changelog also jumps from 2.1.312 to 2.1.314.

The early confusion has a traceable source. OpenSourceMalware's write-up first attributed the sample to Open VSX; it now carries an update saying Cursor contacted them and that the compromise happened in the Cursor Marketplace, and it lists the npm package, the Open VSX extension and Microsoft's marketplace version as not malicious. It also says plainly that the provenance of the analyzed sample "is not established." StepSecurity's blog still describes the build as distributed through Open VSX and mirrored by Cursor, which is hard to square with the Open VSX change feed.

Security researcher Kevin Beaumont went furthest. In a Mastodon thread he wrote that "Anthropic got compromised," that the extension "has millions of installs," and later argued that Cursor's phrase "not developed by Anthropic" was doing "heavy lifting" because the build sat under Anthropic's verified publisher name. That last point is fair as far as it goes: the package carried Anthropic's extension ID. But a publisher name in Cursor's marketplace says nothing on its own about whose credentials or systems were used to put it there.

What Cursor's notice does and doesn't say

Cursor's account of its response is the most telling part. It removed the version, shut down the whole marketplace "out of an abundance of caution," audited access, confirmed no other extensions were tampered with, "rotated our keys, rebuilt the marketplace, and brought it back online." Rotating your own keys and rebuilding your own marketplace are the steps you take when your own distribution system is in question. That is our reading, not something Cursor states: the notice does not say how the modified package got into the marketplace, and neither Cursor nor Anthropic has said so publicly. Reuters reported that Anthropic did not immediately respond to a request for comment, and we found no statement on Anthropic's or Claude's official X accounts as of 13:00 UTC on October 30.

The version number itself was well chosen. 2.1.313 was the next number Anthropic hadn't used yet, so an editor checking for updates would treat it as the newest release and install it. Anthropic's real next release then skipped the number entirely.

What the payload does

Several teams have pulled the sample apart, and their findings agree. Phorion's analysis and OpenSourceMalware's both describe a 66-line function prepended to the extension's normal extension.js. It runs as soon as the editor loads the module, before the extension's own activate callback, so the user never has to open Claude Code or send a message.

The loader:

• appends an Ed25519 public key labeled svc-telemetry to ~/.ssh/authorized_keys;
• tries to switch on the local SSH server;
• opens a reverse SSH tunnel to 134.209.82.225 (ssh -N -R *:0:localhost:22), retrying every 60 seconds, so the operator can reach the machine's port 22 from their own server;
• installs persistence: a user LaunchAgent named com.apple.sysmond on macOS, an @reboot crontab entry on Linux, a SysMon scheduled task or a Startup-folder script on Windows;
• sends a beacon over plain HTTP with the hostname, username, OS, home and working directories, global Git email, public IP, and the names (not values) of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP.

That last list is effectively a shopping list: it tells the operator which machines have cloud credentials worth logging in for.

Sloppy, but don't count on it

The attacker's code has bugs that blunted it. On macOS, Phorion found that it checks whether Remote Login is off by running systemsetup -getremotelogin without admin rights. That prints an "administrator access" error instead of "Off", so the script concludes SSH is already on and never tries to enable it. On a Mac where Remote Login wasn't already enabled, the tunnel connects but leads to a closed port. On Windows, the service setup goes through a helper hardcoded to /bin/sh. Cursor says that, outside unusual cases such as an editor started with administrator rights, the SSH step would have failed, and that it worked with the hosting provider to take the attacker's server offline.

What still happened on affected machines: the key was added, persistence was installed and the host details were sent. And updating doesn't undo any of it. Beaumont reported in the same thread that 2.1.314 does not remove the earlier changes, which matches Cursor's warning that uninstalling the extension "may not be sufficient" because the persistence scripts run on their own.

If you used Claude Code in Cursor on October 29

Cursor's notice has a one-line check (look for svc-telemetry in your authorized keys), remediation scripts for macOS and Windows, and a full list of indicators. If the key is there, the advice is to isolate the machine, run the cleanup, consider rebuilding it, and rotate any credentials that machine could reach, from a different, trusted computer. Users of plain VS Code or the npm CLI have, on current evidence, nothing to clean up.

The bigger lesson is about where the trust actually sits. A coding agent extension runs with everything the editor can touch: source code, SSH keys, cloud tokens. Most developers think of that trust as being in Anthropic or OpenAI. In practice it is also in whichever marketplace mirrors their packages, and in the auto-updater that installs whatever carries the highest version number.