The tampered versions contained JavaScript that ran when modules loaded, collecting host details such as hostname, username, OS, architecture, working directory and global Git email, then attempting to install an SSH key, enable SSH and create a reverse tunnel for persistence. Anthropic said it did not build or publish the modified versions, which never reached the Microsoft Visual Studio Marketplace, Open VSX or the NPM registry, and it pushed a clean version 2.1.314 to avoid confusion.

Cursor removed the extension after identifying it, suspended the marketplace to investigate, found no other malicious extensions, rotated all keys and rebuilt and reopened the store. It also worked with the cloud provider hosting the attacker's server to take it offline, and says there is no evidence other versions or official distribution channels were affected.

There is a partial silver lining: enabling the local SSH service requires admin rights the extension lacks on most macOS and Windows systems, so that step failed, apparently preventing attackers from logging in through the tunnel. Still, Cursor warns that uninstalling the extension may not be enough, because the payload drops standalone persistence scripts that keep running. It has released a detection script and indicators of compromise, and advises isolating affected hosts, removing unauthorised SSH keys and persistence mechanisms, and considering a rebuild.