A developer installed a malicious editor extension (e.g., trojanized Claude Code 2.1.313): find it, remove persistence, rotate what it could reach
For extension-borne backdoors like the Oct 29 Cursor marketplace incident. The extension runs with the developer's permissions, so check for SSH keys, login items and tunnels, not just the extension folder.
Scope
Find who had the bad version.
- Query extension inventories or EDR for the extension folder and version (for 2.1.313: ~/.cursor/extensions/anthropic.claude-code-2.1.313-*)
- Match install or update times against the vendor's exposure window
- Search network logs for the published C2 IPs and ports
Check each host
Look for what the payload leaves behind.
- grep for the attacker key comment in ~/.ssh/authorized_keys and administrators_authorized_keys
- List new LaunchAgents, scheduled tasks, Startup items and @reboot cron entries
- Look for running ssh/autossh reverse tunnels (-R) with host-key checking disabled
Contain and clean
Uninstalling the extension is not enough.
- Isolate hosts with evidence of execution
- Run the vendor's remediation script or remove keys, persistence and processes by hand, then verify nothing remains
- Update to the clean version or remove the extension; rebuild if integrity is in doubt
Rotate
Assume anything reachable from the account was exposed.
- From a clean machine, rotate SSH keys, cloud keys, Git tokens and API keys available on the host
- Revoke active sessions and review recent use of those credentials
Harden
Shrink the next one.
- Keep inbound SSH disabled on developer laptops unless required
- Alert on editor processes writing authorized_keys or creating login items
- Pin and stage updates for high-privilege extensions