Cursor has identified malicious copies of Claude Code extension versions 2.1.312 and 2.1.313 in its marketplace, with attempted SSH backdoors that can leave files running after the extension is removed. Its October 29 security notice, updated October 30, covers macOS and Windows installations during an identified distribution window.
Cursor says the malicious packages were not developed by Anthropic. The notice does not explain how they entered the distribution channel. Developers need to check the package they received and evidence of execution before deciding that an update has resolved their exposure.
Why a failed SSH setup still needs investigation
Security firm Phorion's analysis, updated October 31, says the injected code executes when Node loads the extension file, before its normal activation callback. Opening a feature inside the extension isn't required.
On macOS, Phorion found that the malware checks Remote Login without administrator privileges. The resulting error doesn't match the response its code expects, so it skips enabling SSH. A Mac with SSH disabled can therefore block the inbound access path while still receiving the attacker's key and persistence files.
Phorion says the reconnaissance beacon collects environment variable names, not their secret values. That distinction limits what the beacon itself reveals. It doesn't establish that an affected machine's credentials remained safe: the intended backdoor provides a separate route into the account.
Check the host, beyond the extension
Cursor's response guidance covers installs or updates from its marketplace between 2:27am and 1:35pm Pacific Time on October 29. It advises isolating hosts with execution evidence and rotating accessible credentials and sessions from a trusted system. Uninstalling alone may leave standalone scripts behind.
For investigators, Phorion identifies the planted SSH key's comment as svc-telemetry and recommends checking its fingerprint too. Its macOS analysis also identifies a LaunchAgent named com.apple.sysmond.plist that runs a hidden script in the user's home directory. These are published indicators, not findings from a MrKeyoor test.
Cursor says it removed the malicious packages and took the attacker server offline. The next useful disclosure would explain how distribution was compromised. Until then, a restored marketplace answers a different operational question from whether an affected host has been cleaned.