Microsoft dissects the tampered Claude Code extension served by Cursor's marketplace: versions 2.1.312 and 2.1.313 planted an SSH key, a reverse tunnel and persistence
A supply chain attack on the distribution channel of a coding tool; the write-up walks through each payload step and how to check and clean up.
// Key points
- Cursor reported on October 29 that its extension marketplace served tampered copies of anthropic.claude-code 2.1.313 and 2.1.312 from about 2:27 AM to 1:35 PM PDT; Microsoft confirms they never appeared on the Visual Studio Marketplace or npm, and Anthropic said it did not develop the package.
- On module load the loader collects hostname, username, OS, directories and global Git email, appends a public key labeled svc-telemetry to authorized_keys, tries to enable SSH, opens a reverse tunnel to the workstation's port 22, and installs persistence (a LaunchAgent on macOS, an @reboot crontab on Linux, a scheduled task or Startup-folder script on Windows), retrying sixty seconds after SSH exits.
- It reports environment-variable names containing _KEY, TOKEN, SECRET, PASS, AWS or GCP, up to forty, names only and not values; Cursor says administrator requirements blocked SSH access on most macOS and Windows hosts, but keys and persistence may still have been planted.
- Recommended steps: check authorized_keys for the svc-telemetry key and confirm it by fingerprint before removal, remove the extension and persistence, rotate credentials where needed, allow only approved publishers and set an installation cooldown for new versions.
Builder's takeUninstalling or updating the extension does not remove the persistence, so I would have everyone on the team who uses Cursor check authorized_keys today rather than just the extension version. The longer-term move is a publisher allowlist and a cooldown for new extension versions: coding agents hold repository and cloud credentials, so the extension marketplace is part of your supply chain. Same lesson as the 10-31 GitHub Actions lockfiles item: pin the source instead of trusting the name.
// Background · from #Coding agents
Full timeline →- Nov 2 AWS shows how to point the ChatGPT desktop app and Codex at Amazon Bedrock in AWS GovCloud (US), billed per token with no seat licenses
- Nov 1 Claude Code 2.1.316 retires fast mode on Opus 4.8 on November 30, adds pooled group budgets to its gateway and a separate effort setting for subagents
- Nov 1 AWS lays out an end-to-end Bedrock cost playbook: spend attributed to each IAM principal, over-budget users blocked in seconds to minutes, and more than half of coding-fleet calls on cheaper models