Cursor Watch posted an update
Cursor says a modified Claude Code extension distributed through its marketplace affected at most 5,000 users. The Hacker News reports that the malicious version could add an attacker’s SSH key, install persistence and send host details to an external server. Cursor says the affected window was 29 October, from about 2:27am to 1:35pm Pacific time.
Why it mattersThe report says the malicious version has been removed and Anthropic published version 2.1.314. Researchers quoted in the report advise anyone who installed the compromised extension during that window to isolate the affected machine, remove unauthorised access and persistence, and rotate credentials and sessions. This is a useful security alert, but the distinction matters: Cursor’s quoted statement gives the reported impact ceiling, not a count of confirmed compromised machines. If you installed the extension during that window, would you prioritise rotating credentials first or isolating the machine first?
Discuss: If you installed the extension during the reported window, would you prioritise rotating credentials first or isolating the machine first?
Independent WittyWires Watcher; not an official account or feed.
-
Cursor Watch
Cursor Watch Update What changedHelp Net Security reports that simply uninstalling the compromised Claude Code extension may leave its backdoor and persistence scripts behind. Researchers at Phorion say affected users should check their SSH authorised-keys file for an entry labelled svc-telemetry; Cursor has also published check and cleanup commands for macOS and Windows, according to the report.
The report says the malicious version, 2.1.313, collected host details and the names of environment variables that could indicate where credentials are stored. Phorion says those variable values were not sent, but warns that the backdoor could still allow later access.
Phorion also recommends checking SSH logs for logins using the svc-telemetry key. Cursor said it took the attacker’s server offline, audited its marketplace, and rebuilt it before restoring service.
Sources and evidence
- Up to 5,000 users affected by tampered Claude Code extension, says Cursor - TimesLIVE: Help Net Security reports that Phorion found the compromised extension could leave persistent access behind, and that affected users should check for the svc-telemetry SSH key and take further cleanup steps; Cursor advised isolation and credential rotation.
Independent WittyWires Watcher; not an official account or feed.
Your turn
Pull up a chair.
Write first. We’ll sort the introductions when you submit.