Trojanised Claude Code extension on Cursor marketplace tried to install a persistent SSH backdoor

TLDR

• Cursor says a modified Claude Code extension was on its marketplace on 29 October, affecting at most 5,000 users.¹
• Cursor says the extension added an attacker SSH key, but login was not possible on most macOS and Windows hosts.¹
• Anthropic staff say its systems were not compromised, and Cursor has not said how the malicious upload happened.⁵³

Cursor said on 29 October that it had identified a security incident involving versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension in its VS Code extension marketplace, which it says Anthropic did not develop.¹ According to Cursor, a maliciously modified version was available from about 2:27am to 1:35pm PT that day and runs code that attempts to install a persistent SSH backdoor.¹ Cursor estimates that at most 5,000 users were affected, and The Hacker News and Dark Reading report that it will contact them directly.¹⁶⁷ WIRED reports that Phorion was the first to spot the extension, after detecting it on a customer's Mac.⁵ Cursor says the code collects the hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email and public IP address.¹ It also attempts to add an attacker-controlled SSH key to authorized_keys, switch on the local SSH service and open a reverse SSH tunnel, then tries to make that tunnel persistent through a LaunchAgent on macOS or a scheduled task on Windows, with background scripts retrying roughly every 60 seconds.¹ OpenSourceMalware's Jenn Gile told The Hacker News that the package identifies itself as anthropic.claude-code 2.1.313 but its main JavaScript bundle contains a 66-line loader inserted before the legitimate code.⁶ Netskope reports that the loader sends host details to the attacker's server over HTTP on port 8099, and that the environment variable names it gathers are those matching KEY|TOKEN|SECRET|PASS|AWS|GCP.² The Hacker News says the collected data covers the names of up to 40 such variables and that no follow-on payloads have been observed.⁶ Ars Technica reports that Phorion said the variable names would let an operator inventory cloud credentials and API tokens on a machine.³

Cursor says turning on the local SSH service requires admin rights, which the extension does not have on most macOS and Windows hosts, so the attacker could not have logged in through the tunnel there, although the extension still added the attacker's key, installed persistence and sent host details.¹ WIRED reports that a flaw in the malware's design stopped it fully establishing itself on the vast majority of targets.⁵ Cursor says it removed the version, shut the marketplace down as a precaution, audited access, confirmed that no other extensions were tampered with, rotated its keys and rebuilt the marketplace, and that it worked with the hosting provider to take the attacker's server offline.¹ How the upload happened is not established. Ars Technica reports that independent researcher Kevin Beaumont and Phorion's CTO said 2.1.313 was distributed through Anthropic's official account on Cursor, and that neither Cursor nor Anthropic had explained how attackers gained control of it.³ WIRED reports that Cursor did not answer whether the upload resulted from a breach at Cursor.⁵ WIRED quotes Anthropic's Felix Rieseberg as writing on X that a malicious actor used access to Cursor's marketplace to publish a tampered copy, that the incident was not a compromise of Anthropic's systems or employee laptops, and that versions on Anthropic's official channels are not affected.⁵ Dark Reading quotes Forever Security's Gal Weizman as saying that extensions are most often hijacked through theft of locally stored publishing credentials, and that two-factor authentication for publishing would mitigate the risk.⁷

The outlets differ on several details. On duration, Cursor's notice gives about 2:27am to 1:35pm PT on 29 October, Netskope says roughly 11 hours from about 09:27 to 20:35 UTC, and WIRED and Dark Reading also say about 11 hours.¹²⁵⁷ The Ars Technica headline says "nearly 12 hours", while its body and The Verge give 5:27am to 4:35pm ET.³⁴ On versions, Cursor's notice, updated on 30 October to clarify affected versions, lists 2.1.312 and 2.1.313, while Netskope, Ars Technica and The Hacker News name only 2.1.313.¹²³⁶ On platforms, Cursor's notice covers Windows and macOS, Netskope says the build targets darwin-arm64 and win32-x64 on Cursor and that the backdoor code also handles Linux, WIRED describes the extension as being for Windows, macOS and Linux, and Ars Technica says the code was written to work on all three.¹²⁵³ On other channels, Netskope says the npm and VS Code Marketplace releases of 2.1.313 were pulled as a precaution and that OpenSourceMalware reports those and the Open VSX build were not malicious.² The Hacker News says there is no evidence the version reached Open VSX or Microsoft's marketplace, and notes that an earlier version of its story wrongly said Open VSX was compromised.⁶ On Anthropic's response, Ars Technica reports that Anthropic had not issued a public notice to customers and did not answer its questions, while WIRED quotes two Anthropic staff members posting on X.³⁵ On the fixed release, Ars Technica cites Beaumont as saying Anthropic pushed 2.1.314 several hours after 2.1.313 appeared on Cursor, and The Hacker News says that, as of 30 October, 2.1.314 had been published to Open VSX and the Microsoft marketplace.³⁶

Cursor tells anyone who installed or updated the extension in that period to check ~/.ssh/authorized_keys for a key labelled svc-telemetry, use its remediation scripts, isolate affected hosts, remove the key, persistence and tunnel processes, and rotate credentials and sessions.¹ Both Cursor and Netskope say uninstalling the extension may not be enough, because the payload drops standalone persistence scripts.¹² Netskope lists the attacker server at 134.209.82[.]225, tunnel user tunnel on TCP port 22, and persistence files including ~/Library/LaunchAgents/com.apple.sysmond.plist on macOS and a scheduled task named SysMon on Windows.²

Why it matters: a tampered build shipped under the legitimate anthropic.claude-code extension ID, and Cursor and Netskope both say removing it does not clear the persistence, so exposed hosts need checking and credentials rotating.¹²⁶