A report was issued on October 29, 2026, following the discovery of the compromised extension installing an attacker-controlled SSH key, establishing remote access, and maintaining persistence on affected systems. According to Cursor, the malicious version was accessible for approximately 11 hours from 2:27am to 1:35pm Pacific Time. 

The company estimates that up to 5,000 users could have been affected. 66 lines of JavaScript code were inserted into the main code bundle of the extension by the attackers. The malicious component was designed to execute before the extension's normal functions, allowing it to perform unauthorized activities without requiring any suspicious interaction from users. 

Despite the extension's continued normal operation, the injected code attempted to modify system files and establish connections with attacker-controlled infrastructure in order to alter the extension's behavior. According to researchers, the compromised package was distributed by Cursor under the legitimate extension identifier of Anthropic, anthropic.claude-code. This incident was particularly concerning because the malicious update appeared as an authentic publisher rather than as a mere imitation. 

It remains unclear how the unauthorized package was introduced. Based on Microsoft Threat Intelligence's confirmation, the malicious versions have not been distributed via Microsoft's official Visual Studio Marketplace or Anthropic's npm package. Furthermore, Anthropic confirmed that the company had not been compromised and did not develop the malicious package. Based on the available evidence, Cursor's extension marketplace was the focus of the incident. 

The injectable loader attempted to modify the victim's authorized_keys file to include an SSH public key labelled "svc-telemetry". This modification was intended to enable the attacker to access the affected user's account via SSH. In addition to enabling local SSH services and establishing reverse SSH tunnels to external servers 134.209.82[.]225, the malware also attempted to maintain access to the external server. This was accomplished by incorporating separate persistence mechanisms for Windows, Linux, and macOS, which allowed the backdoor connection to be restarted depending on the platform's startup configurations. 

Additionally, the malicious payload collected information that could allow attackers to identify valuable developer environments by using system information. There was a collection of information on the device hostname, logged-in username, operating system, CPU architecture, home directory, the current working directory, public IP address, and the global Git email configuration. There were also up to 40 environment variables named KEY, TOKEN, SECRET, PASS, AWS and GCP, which contained up to 400 terms. 

Even though the initial beacon did not transmit the values for these variables, this information can be used to identify what cloud services, development platforms and credential types are on a compromised system. As well as sending data to the attacker-controlled server at 134.209.82[.]225:8099/beacon, the loader attempted to send a request to a local loopback address as well. 

It has been determined that the attacker's infrastructure has been permanently shut down with the assistance of its hosting provider, which prevents further communication through the reported server. However, the shutdown does not remove malicious files or persistence mechanisms that are already installed on affected systems. However, researchers have not identified any additional payloads, despite the possibility of attackers executing commands and transferring files via a successful SSH tunnel.

It was later clarified that two malicious versions of the software were released through Cursor's marketplace for Windows and macOS, respectively, during the exposure period of October 29 between 2:27 a.m. and 1:35 p.m. Pacific Time. According to the company, up to 5,000 users may have been affected. They will be contacted directly by the company. Cursor temporarily shut down its marketplace while investigating the incident following discovery of the affected packages. 

A thorough audit of marketplace access by the company revealed no evidence of tampered with other extensions. After rotating the keys of the marketplace and rebuilding the marketplace, the company was able to restore service. Anthropic also confirmed that its official distribution channels and systems were not compromised. 

The extension 2.1.314 was then released through Open VSX and Microsoft's Visual Studio Marketplace. However, Microsoft's Security teams have warned that simply uninstalling it is not sufficient to stop the threat. Scripts, scheduled tasks, cron entries, LaunchAgent files and unauthorized SSH keys marked svc-telemetry should be checked on affected systems. 

When evidence of malicious activity is present, systems should be isolated and confirmed malicious components removed after relevant evidence has been preserved. Additionally, organizations are being advised to review endpoint, network, and authentication logs in order to identify suspicious connections and activity involving SSH. Credentials and active sessions accessed from affected machines should be rotated or revoked from trusted devices.

Whenever unauthorized access is confirmed or its security cannot be restored, it may be necessary to rebuild the system. This incident adds to the series of attacks targeting trusted developer tools in the software supply chain. This follows the attack on OVHcloud's official command-line interface that resulted in the replacement of legitimate release binary packages with malware containing secret stealing features. The combined effect of these incidents demonstrates the risks associated with tampered software updates distributed through otherwise reputable channels.