Your extension inventory needs the download source

Rohan Prabhu's October 30 analysis for StepSecurity, updated November 1, compares the tampered extension with a clean 2.1.312 copy from Open-VSX, another extension registry. Both used the legitimate anthropic.claude-code identifier.

The malicious copy ran an extra JavaScript routine when the extension loaded. Starting a conversation with Claude wasn't required.

The routine collected host information and the names of selected environment variables. Its source didn't read their secret values. It also tried to add an attacker's SSH key and establish a reverse tunnel: an outbound connection that could give the attacker a route back into the machine's SSH login service.

Separate scripts attempted to keep that route available after restart. That matters when we decide whether uninstalling an extension completes recovery.

Cursor's notice scopes exposure to macOS and Windows installs or updates from its marketplace between 09:27 and 20:35 UTC on October 29, for versions 2.1.312 and 2.1.313.

Cursor says errors in the payload and the need for administrator rights generally prevented SSH access. It still reports an added SSH key, persistence and transmitted host details. Its attacker-server takedown doesn't remove those local changes.

The sources reviewed don't establish how many machines received a successful attacker login.

Anthropic's David Dworken clarified that 2.1.313 never appeared on Open-VSX, Microsoft's marketplace or Anthropic's official hosts. Anthropic skipped to 2.1.314 to avoid confusion. That release number helps identify the distribution history; it doesn't tell us what happened on an already exposed host.

Start with the affected download window and marketplace. Before cleanup, preserve the extension files and hashes, SSH and persistence artifacts, and available process and network records through the incident team's collection process. Isolate promptly when execution evidence appears. Hashing reads the file; launching the suspect extension would execute it.

Cursor publishes separate SHA-256 hashes, file fingerprints, for the platform-specific extension packages and for extension.js. Compare like with like. A package hash won't match the hash of the JavaScript file inside it.

Then check endpoint and network history for the listed indicators. Cursor's notice names the svc-telemetry SSH key marker and platform-specific persistence files, including a macOS LaunchAgent and a Windows Startup fallback. A marker search that returns nothing leaves the rest of that evidence unchecked.

For hosts with execution or backdoor evidence, Cursor directs isolation, removal of the key and persistence, and an assessment of whether to rebuild. From a trusted system, rotate credentials the host could access and revoke its sessions. Use its current remediation instructions for the affected platform.

Keep 2 separate entries in the incident record: download exposure and host execution evidence. Give each an evidence link and an explicit unknown state when records are missing. An extension update can change the file we're inspecting while earlier host changes remain.

Ship this week: add download source, installation time and artifact hash to the extension inventory. Pair that record with detection for unexpected SSH tunnels and login persistence. Check for tunnels started indirectly by the editor or later by startup scripts and tasks. Test with a harmless example, and check whether approved SSH activity also triggers alerts.