Affected Systems

Cursor IDE users who installed or auto-updated the Claude Code extension (anthropic.claude-code versions 2.1.312 and 2.1.313) from Cursor Marketplace between 2:27 AM and 1:35 PM PDT on October 29, 2026. Visual Studio Code Marketplace and npm registry were NOT affected. Anthropic systems were not compromised.

Exploitation Status

Active supply-chain attack confirmed. Malicious extensions were live on Cursor Marketplace for approximately 11 hours on October 29, 2026. The injected JavaScript loader executed automatically when the extension loaded, attempting to establish SSH backdoors on affected systems. Success depends on host privileges and SSH configuration, but persistence artifacts may exist even when tunnel access failed.

Business Impact

Organizations with Cursor IDE deployments face potential persistent remote access to developer workstations. Attackers gain SSH backdoor access with reverse tunneling capability, enabling lateral movement and credential theft. The loader collects hostname, username, OS details, Git email, and environment variable names containing KEY, TOKEN, SECRET, PASS, AWS, or GCP. Developer workstations typically have elevated access to source code repositories, cloud infrastructure, and production credentials. Even failed tunnel attempts leave SSH keys and persistence mechanisms requiring manual cleanup.

Urgency

🔴 Immediate

Recommended Actions

  • Identify all systems running Cursor IDE and check for Claude Code extension versions 2.1.312 or 2.1.313 installed or updated on October 29, 2026 between 2:27 AM and 1:35 PM PDT
  • On affected systems, remove the malicious extension, check ~/.ssh/authorized_keys for entries with comment 'svc-telemetry' and delete them, search for hidden files matching pattern .stk_* in user home directories and remove them
  • Review SSH service logs and network telemetry for outbound SSH connections using the 'tunnel' remote account, particularly connections with '-N -R' arguments indicating reverse port forwarding
  • Rotate all credentials and API keys accessible from affected developer workstations, including Git credentials, cloud provider keys (AWS, GCP, Azure), and any secrets stored in environment variables
  • Deploy Microsoft Defender XDR detections and run the provided advanced hunting queries to identify compromised systems and persistence artifacts across the environment