Claude Code extension for Cursor compromised with remote access trojan

A malicious version of the Anthropic Claude Code extension for the Cursor code editor has been discovered distributing a remote access trojan (RAT) to developers' computers. Attackers leveraged unauthorized access to the Cursor marketplace to publish a modified package numbered 2.1.313. According to Cursor, the security incident affected approximately 5,000 developer systems worldwide.

• The malicious package 2.1.313 was published under a verified Anthropic account.
• The extension attempted to install a remote access trojan (RAT) on target machines.
• Around 5,000 systems were impacted, though successful backdoor creation required specific conditions.
• Updating to version 2.1.314 removes the package but does not automatically wipe created SSH backdoors.

Data collection and backdoor mechanics Once executed on a developer's computer, the malicious extension began harvesting sensitive system and user information. It gathered device names, user accounts, operating systems, architecture details, home directories, environment variables, working directories, Git email configurations, and public IP addresses. Following reconnaissance, the code attempted to establish persistent remote access. The script tried to append the attacker's SSH key to the authorized_keys file, enable the local SSH service, and create a reverse SSH tunnel. This tunnel would have allowed external entities to connect directly to the developer's workstation from the outside. To maintain persistence, the backdoor scripts attempted reconnection loops approximately every 60 seconds while transmitting telemetry data.

Scale of the incident and technical limitations Security researchers at Phorion were the first to spot the suspicious activity, publishing KQL queries to help detect indicators of compromise in Microsoft Defender for Endpoint. Cursor acknowledged the breach and disclosed the scale of compromised systems, though exact figures on successfully established remote channels remain unclear due to code flaws. According to Cursor's analysis, persistent access attempts mostly failed because of programming errors within the malicious script, succeeding only under unusual conditions such as running Cursor with administrator privileges. Despite these failures, the automated scripts continuously tried to secure a foothold by reporting system states back to the attacker's server.

Supply chain security implications for developers This security breach represents a classic software supply chain attack, as Anthropic's primary infrastructure was not compromised; rather, the marketplace distribution channel was abused. Although the malicious version 2.1.313 was promptly removed and replaced by version 2.1.314, security analysts warn that simple software updates do not automatically clean up previously generated SSH backdoors or revoke malicious keys. Developers who used the affected version are strongly advised to manually audit their local SSH authorized keys, review environment variables, and inspect active background processes for unauthorized access vectors. The event serves as a stark reminder of the security risks associated with third-party extensions and development environment marketplaces.