Introduction
Developers did not download malware on October 29. Malware downloaded itself to them. For roughly 11 hours, a tampered build of the Claude Code extension sat in the Cursor Marketplace wearing the real publisher identity, and automatic updates did the rest.
What Happened?
Version 2.1.313 of the Claude Code VS Code extension went live in Cursor’s own extension marketplace at 09:27 UTC. It carried the legitimate extension ID, so it wasn’t a typosquat or a lookalike. Anyone whose editor pulled updates during the window received it without a prompt or a click.
The vendor pegged exposure at a maximum of 5,000 users and confirmed the build was not developed by the extension’s actual publisher. It was pulled at 20:35 UTC. The team then took the entire marketplace offline, audited every other extension, rotated keys, and rebuilt the marketplace. A clean 2.1.314 shipped the next day.
One early report blamed the open registry that Cursor mirrors. That attribution has since been retracted by the researchers who made it. Registry change feeds show no publication record for 2.1.313 anywhere else. The open registry, the Microsoft marketplace, and the npm terminal package were never serving it.
No prompt. No chat. Just loading the editor.
The malicious logic sat inside the extension bundle and fired the moment the module loaded. Researchers found it running under plain Node with no editor APIs and no package install hooks involved.
Why most machines escaped the worst of it. Turning on the local SSH service needs administrator rights, which the extension almost never holds. The full interactive backdoor landed mainly where the editor had been run elevated. The recon beacon and the planted key did not need those rights.
What’s the Impact?
The payload fired on module load. No chat session, no install hook, no user action. It collected host details plus the names of environment variables matching key, token, secret, and cloud patterns, then wrote an attacker SSH key into authorized_keys, dropped standalone persistence, and opened a reverse tunnel out.
Most machines escaped the worst of it. Switching on the local SSH service needs administrator rights, which the extension almost never holds, so the full interactive backdoor mostly landed where the editor had been run elevated. The reconnaissance beacon and the planted key needed no such privileges.
Here is the part teams will get wrong: removing the extension does not remediate the host. The persistence lives outside the extension folder and survives the uninstall.
How to Avoid This
- Pin extension versions. Disable silent automatic updates on build and developer machines.
- Sweep installed bundles for the published strings, not just version numbers.
- Treat developer laptops as production. They hold cloud keys and source control tokens.
- Never run the editor elevated. Privilege is what turned recon into a backdoor.
- Rotate credentials from a clean machine, then rebuild hosts where the tunnel connected.
Removing the extension is not remediation.
The loader dropped persistence that lives on its own, outside the extension folder. Pull the bad version and the planted access is still sitting there waiting.
What uninstalling clears
- The tampered bundle itself, version 2.1.313
- The extension folder that carried the loader
- Any future reload of that same code
What is still on the box
- The attacker key appended to
authorized_keys - A scheduled task, launch agent or reboot cron entry
- Hidden config and key files dropped outside the extension
- Every credential that machine could reach, now assumed exposed
The order that works. Check for the planted key first, collect evidence, then strip persistence, then move to the clean version, then rotate source control, pipeline, cloud and registry tokens from a machine you trust. If the tunnel is confirmed to have connected, rebuilding the host beats cleaning it.
Your Marketplace Is Somebody Else’s Deployment Pipeline
A signed identity on a trusted marketplace isn’t proof of a clean build, and uninstalling isn’t the same as recovering. The gap between those two sentences is where this incident lived.
- Red Teammate validates whether the planted key or tunnel could actually reach anything that matters
- SOC Teammate sweeps the fleet for the indicators and assembles the case instead of your analysts grepping laptops one by one
- AppSec Teammate maps which repositories, pipelines, and registry tokens were reachable from the affected machines
- Cloud Teammate checks for follow-on access against the credentials that Beacon cataloged
- Every containment and rotation step pauses at your approval gate, with a full evidence trail for the postmortem