An attacker-modified variant of Anthropic's Claude Code VS Code extension was made available through Cursor's extension marketplace on October 29, remaining accessible for roughly 11 hours and potentially affecting up to 5,000 developers. The malicious package, labeled version 2.1.313, was live between 2:27 a.m. and 1:35 p.m. Pacific Time and contained code designed to deploy persistent SSH backdoors on infected systems.
Cursor, an AI-driven code editor based on Microsoft's open-source Visual Studio Code, supports third-party extensions including Anthropic's Claude Code tool, which integrates the company's AI coding assistant into compatible development environments. While Cursor confirmed that Anthropic did not create the malicious extension, the company has not disclosed how attackers managed to publish a compromised package under Anthropic's identity on its marketplace.
Between about 2:27 am PT and 1:35 pm PT today, a maliciously modified version of Anthropic's Claude Code extension was made available in the Cursor VS Code extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor.
Cursor
How the Attack Worked
Security researchers from Phorion and OpenSourceMalware determined that the attackers injected a malicious JavaScript loader into the start of the extension's extension.js file while preserving the rest of the legitimate code intact. The malicious payload executes automatically when the extension initializes, requiring no user action to trigger the attack.
Once installed, the compromised extension performed multiple actions on affected machines:
- Gathered system metadata and user details, including Git configuration email and external IP address
- Deployed an attacker-controlled SSH key and attempted to activate SSH access while establishing a reverse tunnel connection
- Achieved persistence via macOS LaunchAgent or Windows scheduled task and startup scripts, with retry logic executing roughly every minute
- Transmitted host information and backdoor status to the attacker's infrastructure at IP address 134.209.82[.]225
Implementation Flaws Limited Impact
According to Phorion's analysis, programming mistakes in the malware's SSH configuration routines likely prevented successful remote access on many compromised Windows and macOS machines. The flaws prevented the malware from enabling SSH on systems where the service was not already active, rendering the reverse tunnel unable to function.
On macOS, the malware attempted to verify whether Remote Login was enabled using the systemsetup -getremotelogin command, but executed it without the necessary elevated privileges. Rather than returning the SSH service status, the command returned an administrator-access error. Since the malware only attempted to enable SSH when output showed "Off," it skipped the activation step entirely.
On Windows, the malware tried to install and launch the OpenSSH server through PowerShell but attempted to do so via /bin/sh, a Unix shell unavailable on standard Windows systems. This approach caused the SSH setup to fail.
Despite these failures, the malware could still install SSH keys, establish persistence mechanisms, and attempt to create the reverse tunnel. However, without an active SSH server, the tunnel could not provide access to the compromised device. The malware continued to transmit reconnaissance information to the attacker's server, including the victim's username, hostname, public IP address, Git email, and names of environment variables tied to sensitive credentials. The script did not directly exfiltrate credentials, suggesting attackers planned to retrieve sensitive data manually after gaining SSH access.
Response and Remediation
Cursor removed the malicious extension from its marketplace and temporarily suspended the entire marketplace to conduct a comprehensive audit of other extensions and refresh all access credentials. The company also coordinated with the hosting provider to take the attacker's command-and-control server offline, disrupting both reverse SSH connections and reconnaissance data transmission.
Following its investigation, Cursor reported finding no evidence that other extension versions or official distribution channels were compromised. Developers who downloaded the package during the exposure window should search their systems for an svc-telemetry SSH key and consult Cursor's remediation guidance if they find evidence of infection.
For systems confirmed to be affected, Cursor recommends isolating the machines, rotating all accessible secrets, terminating active sessions, and restoring the environment from verified clean backups.
Scope of the Incident
Early reports suggested that npm, Open VSX, and Microsoft's Visual Studio Code Marketplace had also distributed the malicious extension. However, subsequent investigation confirmed that Cursor was the sole source of the compromised package.
Several critical questions about the supply chain attack remain unresolved, including the method by which threat actors published a malicious extension under Anthropic's name on Cursor's marketplace and whether either Cursor or Anthropic's infrastructure was compromised during the incident.