VS Code Extensions

Cursor Served a Backdoored Claude Code Extension for 11 Hours

On 29 October 2026, between 09:27 and 20:35 UTC, Cursor's extension marketplace served tampered builds of Anthropic's Claude Code extension as Anthropic.claude-code 2.1.312 and 2.1.313 for macOS ARM64 and Windows x64, with a 7,386-byte loader prepended to extension.js that appends an SSH key tagged svc-telemetry, tries to enable Remote Login, opens a reverse tunnel to 134.209.82.225, installs a com.apple.sysmond LaunchAgent or a SysMon scheduled task, and beacons host details. Hands-on: Cursor's gallery at marketplace.cursorapi.com is an Open VSX mirror (links under /open-vsx-mirror/ redirect to cursor-cdn.com blobs, metadata is cached Open VSX JSON, every Claude Code package blob was rewritten on 30 October after the removal); Open VSX, npm and the Microsoft marketplace never had a 2.1.313; the 2.1.312 darwin-arm64 package Cursor serves today is byte-identical to Open VSX's, its Ed25519 signature verifies over the whole package, and its extension.js is 3,685,536 bytes, exactly 7,386 short of the tampered 3,692,922. Cursor's Marketplace Install Cooldown defaults to 0 hours and signature verification is an enterprise Team setting, while VS Code's extensions.autoUpdateDelay defaults to 12 hours, longer than the 11-hour window. Phorion's finding that the macOS enable step fails because systemsetup -getremotelogin exits 0 with an access error that never matches /Off/i. Local sweep on this Mac clean.