How do I rotate API keys and tokens after installing a malicious VS Code or Cursor extension?

What should I check, step by step?

1. Check for the incident's known artifacts first. For the Cursor case, look for svc-telemetry in ~/.ssh/authorized_keys, and on Windows also in C:\ProgramData\ssh\administrators_authorized_keys. Then run the publisher's remediation script or rebuild the machine. Uninstalling the extension may not remove the persistence.

2. Isolate the machine, and do the rotation from a different computer you trust. A backdoor that is still running would see the new secrets you type or paste.
3. List every credential the affected user account could read: ~/.ssh private keys, cloud CLI credential files (~/.aws, gcloud, Azure), ~/.npmrc and other registry tokens, the GitHub CLI and git credential helper, .env files in every workspace you opened, tokens in MCP client configs, and signed-in browser sessions.
4. Revoke, don't only replace. A new key does nothing while the old one still works. On GitHub, revoking an OAuth app or GitHub App authorization also revokes the tokens issued under it, and a revoked token can't be restored.
5. For AWS IAM user keys, create the new key, move your tools to it, then set the old key to Inactive and delete it. AWS's routine procedure suggests waiting days before deleting. After a compromise, deactivate at once and use get-access-key-last-used to see whether the old key was used.
6. For npm, run npm token list, then npm token delete <id> for each token (the id, not the truncated token). npm warns that revocation can take up to an hour.
7. Remove SSH public keys that machine used from GitHub, servers and other services, and make new key pairs on the clean machine.
8. Sign out other sessions and review security logs, such as GitHub's security log (oauth_authorization.destroy marks a revoked token) and your cloud provider's audit trail, for the time the extension was installed.

What the Cursor notice says (Oct 29, 2026)

Cursor says a maliciously modified Anthropic.claude-code 2.1.313, not developed by Anthropic, was in the Cursor VS Code extension Marketplace from about 2:27 AM to 1:35 PM PT on October 29, 2026 (5:27 AM to 4:35 PM ET), and that at most 5,000 users were affected.

• It collected hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email and public IP. It tried to add an attacker SSH key, enable the local SSH service and open a reverse SSH tunnel, with persistence through a LaunchAgent (com.apple.sysmond) on macOS or a scheduled task (SysMon) on Windows.
• Turning on the SSH service needs admin rights, which most macOS and Windows hosts didn't give it, so the attacker couldn't log in through the tunnel there. Cursor says the key, the persistence and the host report happened anyway, and the limited collection of environment variable names doesn't rule out later credential access. That's why the notice still asks you to rotate.
• Cursor says it has no evidence that other versions of the extension or the official distribution were affected. Third-party write-ups disagree about whether the Open VSX copy of 2.1.313 was also malicious (StepSecurity says it was distributed through Open VSX, OpenSourceMalware says the Open VSX extension is not malicious), so treat any install of 2.1.313 as suspect until you have checked.

Order matters

Rotating first and cleaning later hands the new secrets to whatever is still running. Clean or rebuild the machine, rotate from a trusted machine, and only then put the new secrets on the cleaned one.

• Revoke the highest-impact credentials first: cloud admin keys, package-registry publish tokens and GitHub tokens with write access to code, because those let an attacker spread to other people.
• Keep notes of what you revoked and when. If a provider's logs later show the old credential being used, the timestamps tell you whether it was before or after you cut it off.