Backdoored Claude Code extension hit Cursor Marketplace for 11 hours

Phorion points to an implementation mistake in the macOS path. The script runs systemsetup -getremotelogin without elevation and only tries to enable Remote Login if the output matches "Off". Run as a standard user, the tool refuses to read the setting, prints an administrator-access error and exits with status 0 instead.

Because the check never sees "Off", the enablement step is skipped entirely. On a Mac that was not already running SSH, the inbound access path is broken, even though the keys and persistence are still dropped. Phorion also flags a likely bug in the Windows path, where a PowerShell service command is passed through a helper that hardcodes /bin/sh.

Even so, the researchers stress the payload is still a serious threat: it installs persistence and beacons host reconnaissance back to the operator. Non-interactive sudo -n will also fail unless the user already has passwordless sudo configured.

Once the malicious release was found, Cursor removed it and also pulled the 2.1.313 versions from the npm and VS Code registries, according to Phorion. Cursor then took the entire marketplace offline and reinstated it after working with providers to neutralize the malware and confirming there was no further risk.

The company says no other extensions were affected. Phorion advises organisations to immediately review their environments for use of Claude Code for VS Code 2.1.313 and to engage incident response wherever the extension is found.

When hunting for this activity, Phorion recommends checking the SSH public-key fingerprint rather than relying on the svc-telemetry comment string, since the script only checks for the comment before appending.

If you use Cursor or VS Code with Claude Code and installed anything in the affected window, treat your developer machine as potentially compromised. Check whether you are running version 2.1.313, inspect ~/.ssh/authorized_keys for an unknown Ed25519 key — remember the svc-telemetry comment may be absent or reused — and rotate SSH keys and any credentials that were reachable from that machine.

This is a supply-chain attack on a marketplace, not a flaw in the underlying AI model, so the fix is version hygiene, not uninstalling your tools. Install extensions only from verified publishers, keep an eye on release versions and prefer signed builds where available.

There is no word yet on availability or pricing implications in Tunisia, since the extension is free and distributed through editor marketplaces rather than local channels. Tunisian developers and studios using Cursor should act on the version check today.