Cursor marketplace: a tampered Claude Code extension (versions 2.1.312 and 2.1.313) planted an SSH key, a reverse tunnel and persistence for about eleven hours on 2026-10-29; uninstalling it does not remove the persistence

Between about 2:27am PT and 1:35pm PT on 2026-10-29 (09:27 to 20:35 UTC) a maliciously modified copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 for macOS and Windows, was served from the Cursor VS Code Extension Marketplace; Cursor removed it, shut the marketplace down briefly, rotated its keys, rebuilt it and had the hosting provider take the attacker's server offline (Cursor, 2026-10-29). Anthropic told Microsoft its systems were not compromised and that it did not build the package, and Microsoft confirms the packages were never published to the Visual Studio Marketplace or npm (Microsoft Threat Intelligence, 2026-10-30). How the attacker published under Anthropic's name is not disclosed in any source read. Cursor estimates up to 5,000 affected users (Sophos X-Ops, 2026-10-30).

The injected loader runs when the extension module loads. It reports host and user data (hostname, username, operating system, home and working directories, the configured Git email, environment-variable names and public IP address), appends an attacker-controlled SSH public key to authorized_keys, tries to enable the local SSH service and open a reverse SSH tunnel, and installs persistence outside the extension: a LaunchAgent on macOS, and on Windows a scheduled task that asks to run as SYSTEM with a Startup-folder fallback, with background scripts retrying the tunnel about every 60 seconds (Cursor, 2026-10-29). Microsoft's analysis adds a user crontab entry for Linux (Microsoft Threat Intelligence, 2026-10-30). Because of coding errors the step that enables SSH fails unless Cursor was started with administrator privileges, so on most hosts the attacker could not log in through the tunnel, but the key, the persistence and the host report still happened (Cursor, 2026-10-29).

Triage: a running SSH process is not proof the attacker got in, since both ends must allow the connection (Microsoft Threat Intelligence, 2026-10-30); administrators run tunnels too, and what separates this one is an editor extension as the parent process and persistence written to user-writable locations rather than a managed service.