A malicious version of Anthropic's Claude Code extension distributed through Cursor's extension marketplace for roughly 11 hours on October 29 exposed up to 5,000 developers to malware designed to install persistent SSH backdoors.
Cursor warned that "between about 2:27 am PT and 1:35 pm PT today, a maliciously modified version of Anthropic's Claude Code extension was made available" that "runs malicious code that attempts to install a persistent SSH backdoor." Researchers found the attackers inserted a malicious JavaScript loader at the beginning of the extension's extension.js file, leaving the rest of the legitimate code unchanged. The malware executed when the extension loaded, without requiring user interaction with Claude Code.
The malware collected system and user information, added an attacker-controlled SSH key, attempted to enable SSH access and establish a reverse tunnel, and installed persistence through a macOS LaunchAgent or Windows scheduled task. It sent host details and backdoor status to the attacker's server at the IP address 134.209.82.225.
However, according to Phorion, coding errors in the malware's SSH setup routines likely prevented attackers from gaining remote access to many affected Windows and macOS systems. On macOS, the malware's attempt to check Remote Login status ran without elevated privileges, producing an error rather than the service's status. On Windows, it attempted to install OpenSSH via a Unix shell that is not available on standard Windows installations. The malware still sent reconnaissance data to the attacker's server.
Cursor removed the malicious extension and temporarily shut down its entire marketplace to audit other extensions and rotate all access keys. The company also worked with the hosting provider to take the attacker's server offline. Cursor says it found no evidence any other extension versions or the official distribution were affected. Cursor has not explained how the attackers published under Anthropic's name, leaving questions about the supply chain attack unanswered. Users who downloaded the package during the exposure window should check for the presence of an svc-telemetry SSH key on their machines and follow Cursor's remediation instructions if impact is confirmed.
Analysis
Why This Matters
- Demonstrates how AI coding assistants can become a vector for sophisticated supply chain attacks.
- Highlights the security challenges and trust implications of extension marketplaces for developer tools.
- Shows that even flawed malware can successfully exfiltrate sensitive reconnaissance data.
Background
Cursor is an AI-powered code editor forked from Microsoft's open-source VS Code, with support for VS Code extensions. Anthropic's Claude Code extension brings its AI coding assistant directly into compatible editors, helping developers write and debug code. Supply chain attacks targeting developer tools and environments have become an increasingly common tactic for threat actors.
Key Perspectives
- Cursor: Warned users of the malicious extension, shut down its marketplace for a full audit, and stated it found no evidence any other extensions were affected. The company has not explained the initial breach vector.
- Researchers (Phorion/OpenSourceMalware): Detailed the malware's technical execution, noting that while operational coding errors limited the SSH backdoor's effectiveness, the malware still successfully transmitted sensitive system data to the attackers.
- Affected Developers: Up to 5,000 users were potentially exposed. Cursor has advised them to check for a specific SSH key and follow remediation steps, including isolating machines and rotating secrets.
What to Watch
- How the attackers gained the ability to publish a malicious extension under Anthropic's name on Cursor's marketplace.
- Whether the breach originated from Cursor's or Anthropic's internal systems and infrastructure.
- Potential changes to extension marketplace security protocols, such as mandatory code review or signing requirements.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedA malicious Claude Code extension on Cursor planted SSH backdoors.BleepingComputer: “Malicious Claude Code extension on Cursor planted SSH backdoors.”
- SupportedUp to 5,000 developers were exposed before Cursor pulled the package.BleepingComputer: “exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.”
- SupportedThe malicious extension was distributed for about 11 hours on October 29.BleepingComputer: “A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29”
- SupportedCursor said the maliciously modified extension was available in its marketplace between about 2:27 am PT and 1:35 pm PT that day.BleepingComputer: “"Between about 2:27 am PT and 1:35 pm PT today, a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace," warned Cursor .”
- SupportedCursor said the extension ran code that attempted to install a persistent SSH backdoor.BleepingComputer: “"The extension runs malicious code that attempts to install a persistent SSH backdoor."”
- SupportedResearchers found a malicious JavaScript loader at the beginning of extension.js, with the legitimate code otherwise unchanged.BleepingComputer: “Researchers at Phorion and OpenSourceMalware found that the attackers inserted a malicious JavaScript loader at the beginning of the extension's extension.js file, leaving the legitimate extension code otherwise unchanged.”
- SupportedThe malware executed when the extension loaded, without requiring user interaction with Claude Code.BleepingComputer: “The malicious code executes when the extension loads, without requiring user interaction with Claude Code.”
- SupportedThe malware collected system and user information, and added an attacker-controlled SSH key while attempting to enable SSH access and establish a reverse tunnel.BleepingComputer: “Collects system and user information, including Git email and public IP address. Adds an attacker-controlled SSH key and attempts to enable SSH access and establish a reverse tunnel.”
- SupportedThe malware installed persistence through a macOS LaunchAgent or a Windows scheduled task.BleepingComputer: “Installs persistence through a macOS LaunchAgent or Windows scheduled task/Startup script”
- SupportedThe malware sent host details and backdoor status to the attacker's server at 134.209.82.225.BleepingComputer: “Sends host details and backdoor status to the attacker’s server at the IP address 134.209.82[.]225”
- SupportedPhorion said coding errors likely prevented attackers from gaining remote access to many affected Windows and macOS systems.BleepingComputer: “according to Phorion, coding errors in the malware's SSH setup routines likely prevented attackers from gaining remote access to many affected Windows and macOS systems.”
- SupportedCursor temporarily shut down its entire marketplace to audit other extensions and rotate all access keys.BleepingComputer: “Cursor removed the malicious extension and temporarily shut down its entire marketplace to audit other extensions and rotate all access keys before making it available again.”
