Malicious Claude Code Extension on Cursor Marketplace Planted SSH Backdoors for 11 Hours
A maliciously modified version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for roughly 11 hours on October 29, exposing up to 5,000 developers to malware designed to install a persistent SSH backdoor, though coding errors in the malware limited its effectiveness on many systems.
BleepingComputer
A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install a persistent SSH backdoor.
The compromised package, published under version number 2.1.313, was available between 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor, an AI-powered code editor built from Microsoft's open-source Visual Studio Code, supports VS Code extensions, and Anthropic's Claude Code extension brings the company's AI coding assistant into compatible editors to help developers write and debug code using natural-language instructions.
Cursor said Anthropic did not develop the malicious extension, but the company has not explained how attackers were able to distribute the compromised package under Anthropic's name. In a warning, Cursor stated that the extension runs malicious code that attempts to install a persistent SSH backdoor.
Researchers at Phorion and OpenSourceMalware found that attackers inserted a malicious JavaScript loader at the beginning of the extension's extension.js file, leaving the legitimate extension code otherwise unchanged. The malicious code executes when the extension loads, without requiring any user interaction with Claude Code.
According to Phorion, coding errors in the malware's SSH setup routines likely prevented attackers from gaining remote access to many affected Windows and macOS systems. On macOS, the malware attempts to check whether Remote Login is enabled using the systemsetup -getremotelogin command but runs it without elevated privileges, producing an administrator-access error instead of the service status. Because the malware only tries to enable SSH when the output contains "Off," it skips the activation step entirely. On Windows, the malware attempts to install and start the OpenSSH server through PowerShell but does so via /bin/sh, a Unix shell not available on standard Windows installations, causing the setup to fail.
In both cases, the malware can still install its SSH keys, establish persistence, and attempt to create a reverse tunnel, but if the SSH server is not already running, the tunnel cannot provide access to the compromised machine. Even when the backdoor fails, the malware sends reconnaissance data to the attacker's server, including the victim's username, hostname, public IP address, Git email address, and the names of environment variables associated with sensitive credentials. The script does not directly steal credentials, suggesting the attackers intended to retrieve sensitive data manually after gaining access through the SSH tunnel.
Cursor removed the malicious extension and temporarily shut down its entire marketplace to audit other extensions and rotate all access keys before restoring it. The company also worked with the hosting provider to take the attacker's server offline, disrupting both the reverse SSH connections and the transmission of reconnaissance data. Following an internal investigation, Cursor said it found no evidence that any other extension versions or the official distribution were affected.
Users who downloaded the package during the exposure window should check for the presence of an 'svc-telemetry' SSH key on their machines and follow Cursor's remediation instructions if impact is confirmed. For impacted machines, the recommended steps are to isolate them, rotate accessible secrets, invalidate sessions, and rebuild the affected environment from safe backups.
While initial reports suggested that npm, Open VSX, and Microsoft's Visual Studio Code Marketplace were also impacted, it was later confirmed that Cursor was the only source distributing the malicious extension. Many questions remain unanswered, including how the threat actors published a malicious extension under Anthropic's name and whether Cursor or Anthropic's systems were compromised during the incident. BleepingComputer contacted both companies and will update its reporting if a response is received.