Claude Code extension 2.1.313 malware: how to check

If you use Cursor and installed or auto-updated the Claude Code extension on October 29, check one file: look in ~/.ssh/authorized_keys for a key labeled svc-telemetry. If it's there, you got the malicious 2.1.313 build, and you need to remove the backdoor and rotate credentials. Uninstalling the extension won't do it on its own.

What Cursor posted

@cursor_ai posted about it early Friday. The post reports "a security incident affecting a modified Claude Code VS Code extension" in Cursor's extension marketplace, says at most 5,000 users were affected, and states plainly: "This malicious version of the extension was not developed by Anthropic." Cursor asks everyone to update to version 2.1.314. It also says it took the marketplace down, worked with providers to neutralize the malware, and has since brought the marketplace back.

The full security notice on Cursor's blog puts the exposure window at roughly 2:27am to 1:35pm Pacific on October 29. The Hacker News reports that Anthropic has published a clean 2.1.314 to both Open VSX and the Microsoft VS Code Marketplace. Help Net Security says no malicious version has been reported on Microsoft's marketplace. Early reports also named Open VSX, but that has been disputed, and The Hacker News now traces the incident to Cursor's marketplace.

What the backdoor does

Cursor's analysis says the tampered extension.js collects host and user details, adds an attacker's SSH key, opens a reverse SSH tunnel to a remote server, and installs persistence so it survives restarts. It retries the tunnel about every 60 seconds and sends beacons over plain HTTP to port 8099. Cursor says the attacker's server is now offline, but the persistence scripts stay on the machine after the extension is removed, so a machine that got hit stays dirty until someone cleans it.

A coding extension runs with your user permissions, sees your repos and environment variables, and lives in the tool you leave open all day. Cursor warns that the limited environment-variable collection "does not rule out later credential access over the backdoor."

How to check your machine

These are Cursor's commands, quoted from its notice.

macOS (Terminal):

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Windows (PowerShell):

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

Other signs to look for, all taken from Cursor's indicator list:

Help Net Security also reports a Linux cron entry that runs at reboot, which Cursor's notice doesn't cover. If you run Cursor on Linux, check your crontab too.

If the key is there

Cursor's steps, in order:

1. Isolate the machine from the network.
2. Run Cursor's remediation script: remediate-macos.sh as your normal user (not root) on a Mac, or remediate-windows.ps1 from an administrator PowerShell on Windows. The scripts exit with an error if anything remains.
3. Decide whether to rebuild the machine. Cursor raises this option itself.
4. From a different, trusted computer, rotate every credential the affected machine could reach: API keys, cloud tokens, GitHub tokens, SSH keys, database passwords, and active sessions.
5. Update the Claude Code extension to 2.1.314.

If the check comes back clean and you're on 2.1.314, you're fine. Cursor says it has no evidence that other versions or Anthropic's official distribution were affected.

The bigger lesson for small teams

We covered the LiteLLM 1.107.0 compromise and the AGENTS.md downloads attack just in the last couple of weeks. Each time, the attacker went after something developers trust and let update on its own, and AI coding tools are now high on that list.

For a five-person shop, the defenses are mostly boring habits. Know which extensions are installed on the machines that hold your client data. Keep long-lived keys out of plain environment variables, and use a manager like the one in our 1Password for agents post. Have a written plan for rotating credentials before you need one. If you're running Claude Code with background jobs, our guide to Claude Code MCP tasks covers what those agents can reach.

You can adopt AI tools fast and still stay safe, as long as one person owns the list of what's installed and what it can reach. If you'd like a second set of eyes on how your team's tools, keys and automations fit together, New Face Design's free process audit is a good place to start.