Cursor Says Its Marketplace Was Source of Backdoored Claude Code Build

Cursor identified its marketplace as the source of a backdoored Claude Code extension, whose code was designed to give attackers persistent remote access to developer machines.

The analyzed package was version 2.1.313 for macOS on Apple Silicon. A 66-line loader placed before the extension’s normal code could run when the extension loaded, even if a user had not started a Claude conversation.

The loader was designed to add an attacker-controlled SSH key labeled svc-telemetry, create startup persistence and open a reverse tunnel to 134.209.82.225. It also sent host information to that server on port 8099.

The distribution path is disputed. A malicious copy was also found on Open VSX, while the provenance of the analyzed directory was not established.

No affected-device count, successful remote access or cryptocurrency theft has been confirmed. The analyzed code contained no blockchain addresses, wallet references, contracts or RPC endpoints, making the concern for crypto teams potential access through developer machines and the accounts they can reach.