Up to five thousand developers installed a malicious version 2.1.313 of the official Claude Code extension via the Cursor marketplace, exposing corporate repositories to a backdoor for eleven hours. The attack window spanned October 29 from 02:27 to 13:35 Pacific Time, after which Anthropic released update 2.1.314.
Key points
Malicious update 2.1.313 of Claude Code distributed via Cursor marketplace for 11 hours. Up to 5,000 developers downloaded the compromised extension on October 29. Sixty-six lines of code injected the svc-telemetry key into authorized_keys and established persistence. Exfiltration targeted hostnames, git-email, environment variables, API keys, and access tokens via a reverse tunnel.
The incident demonstrates that developer tool supply chains remain an unmitigated vector for enterprise infrastructure compromise, bypassing perimeter security via trusted third-party plugins.
This supply chain incident highlights structural vulnerabilities in developer tool marketplaces, directly threatening enterprise source code repositories. Sixty-six lines of malicious code executed upon extension loading, appending the svc-telemetry key to authorized_keys, configuring persistence via LaunchAgent, cron, and Windows scheduled tasks, and opening a reverse tunnel to transmit hostnames, git-email addresses, and environment variable names containing KEY and TOKEN.
Simply removing the compromised extension fails to remediate the exposure, as access keys and persistence mechanisms remain intact on the host system. Security teams must manually audit authorization files using the command grep svc-telemetry ~/.ssh/authorized_keys and rotate compromised credentials exclusively from uncompromised machines.
The bottom line
Developer productivity tooling represents an unmonitored attack vector that bypasses traditional perimeter defenses. How many engineering teams have audited their AI extensions for supply chain persistence mechanisms?