What happened. Researchers found a 66-line loader placed in front of the real extension code. When the editor starts, it adds an attacker key labeled svc-telemetry to ~/.ssh/authorized_keys, tries to open a reverse tunnel to 134.209.82[.]225, installs persistence (a scheduled task on Windows, a crontab on Linux, a LaunchAgent on macOS) and sends host details to port 8099 over plain HTTP. Cursor briefly shut its marketplace to pull the package. How the attacker got the update published is still unclear.
Why it matters. This wasn't a lookalike extension. It came through as a normal update to the real one, so anyone with auto-update on got it without clicking anything. Developer laptops hold cloud keys, CI tokens and source code, and the Binance theft this week started from one engineer's laptop. Cursor says the SSH login step needs admin rights, so on most Mac and Windows machines the tunnel likely failed, but the key, the persistence and the beacon still landed. No follow-on payload has been seen. Copies from Open VSX and Microsoft's VS Code Marketplace aren't known to be affected.
What I'd do today. Check whether anyone on your team ran Claude Code 2.1.313 from Cursor's marketplace on Oct 29. On those machines, isolate the host, remove the svc-telemetry key and the persistence entries, block 134.209.82[.]225, and rotate cloud, Git and CI credentials and sessions. Update to 2.1.314. Then decide whether developer editors should be allowed to auto-update extensions at all.