Cursor says a maliciously modified build of Anthropic's Claude Code VS Code extension, Anthropic.claude-code version 2.1.313, was available in the Cursor IDE extension marketplace between about 5:27 AM and 4:35 PM ET on Oct 29 (2:27 AM to 1:35 PM PT). Anthropic did not build it. Cursor says at most 5,000 users were affected and it will contact them directly. The official Claude Code npm package, the Microsoft VS Code Marketplace build and Open VSX are not affected, per Cursor and OpenSourceMalware (which first reported the package and later corrected that it came from Cursor's marketplace, not Open VSX).

• What it did: a short loader prepended to extension.js ran as soon as the extension loaded, no chat needed. It collected hostname, username, OS, home and working directories, global Git email, public IP and the names of environment variables that look like secrets; appended an attacker SSH key labeled svc-telemetry to authorized_keys; tried to enable the local SSH service; opened a reverse SSH tunnel to 134.209.82.225 retrying about every 60 seconds; added persistence (macOS LaunchAgent com.apple.sysmond, Windows scheduled task SysMon or a Startup script, Linux @reboot cron per OpenSourceMalware); and beaconed host details to port 8099.
• Limits: Cursor says enabling SSH needs admin rights, so on most macOS and Windows hosts that step failed and the attacker could not log in through the tunnel. The attacker server has been taken offline with the hosting provider. The key, persistence and data beacon still happened, so clean up anyway.
• Cursor's response: pulled the version, shut down the whole marketplace, audited access, says no other extensions were tampered with, rotated its keys, rebuilt the marketplace and brought it back. It asks everyone to update to 2.1.314.

Do now: run grep -qs svc-telemetry ~/.ssh/authorized_keys (and on Windows also check C:\ProgramData\ssh\administrators_authorized_keys). If it is found, isolate the host, run Cursor's remediation script, consider a rebuild, and rotate credentials and sessions from a clean machine. Uninstalling the extension is not enough. Not yet disclosed: how a modified build under the real publisher ID got into the marketplace.