A malicious version of Anthropic’s Claude Code extension was distributed through the Cursor code editor’s extension marketplace for approximately 11 hours, potentially exposing up to 5,000 developers to malware designed to establish unauthorised access to their computers.
Cursor disclosed the incident on October 29, identifying the affected package as Anthropic.claude-code version 2.1.313. The company said the modified extension was not developed by Anthropic and that it would contact potentially affected users directly.
The malicious package was available between approximately 2:27 am and 1:35 pm Pacific Time on October 29. Cursor has since removed it and taken additional steps to disrupt the attack.
Malicious Extension Attempted To Install An SSH Backdoor
According to Cursor’s security notice, the modified extension contained code designed to collect information about the computer and its user. The information included the device hostname, username, operating system, architecture, home directory, working directories, configured Git email and public IP address.
The malware also attempted to add an attacker-controlled SSH key to the system’s authorised keys file. It then tried to enable the local SSH service and establish a reverse SSH tunnel, potentially allowing an attacker to connect remotely.
The extension attempted to maintain this access through background mechanisms. On macOS, it used a LaunchAgent, while Windows systems were targeted through scheduled tasks and startup scripts.
The malicious code also attempted to send collected system details and the status of the backdoor to an external server.
Coding Errors Limited Remote Access On Many Systems
Cursor said the malware’s attempt to enable SSH access would fail on most macOS and Windows computers because the operation required administrator privileges that the extension generally did not have.
BleepingComputer’s analysis also identified errors in the SSH setup routines that could prevent the remote-access mechanism from working on machines where SSH was not already enabled.
However, this did not make the incident harmless. Cursor said the extension could still add the attacker’s SSH key, install persistence mechanisms and transmit system information even when the remote tunnel could not be established.
The distinction is important because a failed backdoor connection does not necessarily mean that an affected computer was left untouched.
Cursor Shuts Down Marketplace And Rotates Security Keys
After identifying the malicious package, Cursor immediately removed it and blocked further distribution. The company also temporarily shut down its entire VS Code extension marketplace as a precaution.
It subsequently audited the marketplace, rotated its security keys, rebuilt the platform and restored access.
Cursor said its investigation found no evidence that other extensions had been tampered with. It also said the findings concerned the identified package and that it had no evidence of other Claude Code versions or Anthropic’s official distribution being affected.
The company worked with the hosting provider to take the attacker’s server offline, disrupting the reverse SSH connection and the transmission of collected information.
Only Cursor Marketplace Identified As Distribution Source
The incident initially generated confusion over where the malicious extension had been distributed. Early reports pointed towards Open VSX and other software registries.
However, subsequent checks by software supply-chain security firm Socket found no corresponding publication record for version 2.1.313 on Open VSX or npm. Cursor’s own disclosure identified its VS Code extension marketplace as the distribution channel.
The incident therefore does not establish that Anthropic’s official software distribution infrastructure was compromised. Cursor specifically stated that the malicious version was not developed by Anthropic.
How the modified package entered Cursor’s marketplace and appeared under Anthropic’s extension identity has not yet been publicly explained.
What Developers Should Know
Cursor has advised anyone who installed or updated to version 2.1.313 through its marketplace during the exposure window to check their systems and follow its remediation instructions.
The company has identified an unauthorised SSH key labelled svc-telemetry as an indicator of compromise. Users who find evidence of the malicious package should remove the unauthorised key, persistence mechanisms and running tunnel processes, and assess whether their systems need to be rebuilt.
Uninstalling the extension alone may not be sufficient because the malicious code attempted to leave separate background scripts on affected machines. Cursor has also advised users to rotate credentials and invalidate sessions that may have been accessible from compromised systems.
The incident highlights the security risks associated with software extension marketplaces, particularly when developer tools can access source code, terminal environments and sensitive project information. Even a familiar extension name and version number cannot independently establish that a downloaded package is authentic.
