Microsoft Finds SSH Backdoor in Claude Code 2.1.313 on Cursor, Exposing Up to 5,000 Users
Updated
Updated · Microsoft · Oct 30
Microsoft Finds SSH Backdoor in Claude Code 2.1.313 on Cursor, Exposing Up to 5,000 Users
3 articles · Updated · Microsoft · Oct 30
Summary
Microsoft said the trojanized Claude Code extensions on Cursor—versions 2.1.312 and 2.1.313—loaded injected JavaScript that tried to add an attacker SSH key, enable local SSH, open a reverse tunnel and persist across reboots.
The code also gathered host details including hostname, username, OS, Git email and up to 40 environment-variable names matching terms like KEY, TOKEN, SECRET, AWS or GCP, then attempted to beacon them to 134.209.82.225:8099.
Cursor said the malicious packages were live from about 2:27 a.m. to 1:35 p.m. PDT on Oct. 29, while Microsoft said Visual Studio Marketplace and npm were unaffected and Anthropic's own systems were not compromised.
Microsoft warned that failed tunnel setup did not mean a clean device, because the loader could still plant SSH keys and persistence artifacts such as com.apple.sysmond.plist, .smt scripts, SysMon tasks or Startup-folder files.
Organizations are being told to hunt for installs from Cursor, preserve evidence, remove unauthorized keys and startup items, and rotate credentials or rebuild devices if telemetry shows exposure.