Cursor Says Malicious Anthropic.claude-code Versions 2.1.312 and 2.1.313 Were Offered in Its Marketplace and Tried to Install an SSH Backdoor
Cursor says modified Claude Code extension versions 2.1.312 and 2.1.313 were available in its VS Code extension marketplace on October 29 and tried to install an SSH backdoor; it says Anthropic did not develop them and reports it removed them and rotated keys.
Overview
Cursor says that a maliciously modified version of Anthropic’s Claude Code extension was available in the Cursor VS Code Extension Marketplace on October 29. In its security notice, the company names the affected packages as Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and MacOS and states: “These malicious versions of the extension were not developed by Anthropic.”
What Cursor Reports
According to Cursor, the malicious version was available between about 2:27am PT and 1:35pm PT on October 29. BleepingComputer describes this as approximately 11 hours and says up to 5,000 developers were exposed.
Cursor lists three things the extension attempts to do:
- It collects and reports host and user information, including hostname, username, OS, architecture, home directory path, environment variable names, working directories, configured Git email and public IP.
- It attempts to add an attacker-controlled SSH key to authorized_keys, enable the local SSH service and open a reverse SSH tunnel.
- It attempts to make the tunnel persistent through a LaunchAgent on macOS, or a scheduled task with a Startup-script fallback on Windows, with background scripts retrying roughly every 60 seconds.
Cursor also says that turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts, so on those hosts the attacker could not have logged in through the tunnel. In the same notice, Cursor says the extension still added the attacker’s SSH key, installed persistence and sent host details to the attacker.
BleepingComputer, citing researchers at Phorion and OpenSourceMalware, reports that the attackers inserted a malicious JavaScript loader at the beginning of the extension’s extension.js file and left the legitimate extension code otherwise unchanged. It adds that the code runs when the extension loads, without requiring user interaction with Claude Code. According to the same report, coding errors in the SSH setup routines on macOS and Windows likely prevented attackers from gaining remote access to many affected systems.
Cursor’s Response
Cursor says it removed the malicious version from the marketplace upon detection, blocked further distribution and then shut down the marketplace entirely “out of an abundance of caution”. The company says it audited access and confirmed no other extensions were tampered with, rotated its keys, rebuilt the marketplace and brought it back online. It also says it worked with the cloud provider hosting the attacker’s server to take it offline.
Cursor says it has no evidence that other versions of the extension or the official distribution are affected. BleepingComputer reports that while initial reports suggested that npm, Open VSX and Microsoft’s Visual Studio Code Marketplace were also impacted, it was later confirmed that Cursor was the only source distributing the malicious extension.
Guidance for Affected Users
Cursor’s guidance applies to anyone who installed or updated to version 2.1.312 or 2.1.313 from the Cursor marketplace on macOS or Windows during the window. The notice says the extension appends an attacker’s public key labeled svc-telemetry to the SSH authorized keys, and it provides commands to check for that key plus remediation scripts for macOS and Windows. Cursor says that uninstalling the extension may not be sufficient because the payload drops standalone persistence scripts that keep running. It recommends rotating credentials and sessions accessible from affected hosts and assessing whether a host should be rebuilt.
What Is Not Yet Known
BleepingComputer says Cursor states that Anthropic did not develop the malicious extension but has not explained how attackers distributed the compromised package under Anthropic’s name. It lists as unanswered how the threat actors published the extension on Cursor’s marketplace and whether Cursor or Anthropic’s systems were compromised, and says it contacted both companies and will update its story if it receives a response.
The two sources differ on scope. BleepingComputer’s report refers to version 2.1.313, while Cursor’s notice, which carries an October 30 update saying it “updated the IOCs and clarified affected versions”, names both 2.1.312 and 2.1.313.