Malicious Claude Code extension on Cursor planted SSH backdoors

On October 29, a malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace. The rogue package, bearing version number 2.1.313, remained available for approximately 11 hours, exposing up to 5,000 developers to persistent security threats.

• A malicious extension was active on Cursor's marketplace for about 11 hours on October 29.
• Up to 5,000 developers were exposed to a backdoor installation payload.
• Coding bugs in the malware prevented successful remote SSH access on most systems.
• Cursor temporarily shut down its marketplace to audit extensions and revoke access keys.

Attack Details and Malware Mechanics

Security researchers from Phorion and OpenSourceMalware discovered that threat actors inserted a malicious JavaScript loader at the beginning of the extension's extension.js file. This allowed the malicious payload to execute automatically upon loading the extension, requiring no user interaction with Claude Code while preserving its core coding assistant functionality.

Once installed, the compromised extension collected sensitive system and user information, including Git email addresses and public IP addresses. It attempted to add an attacker-controlled SSH key, establish a reverse tunnel, and ensure persistence via macOS LaunchAgents or Windows startup scripts, reporting host details back to the attacker's server at 134.209.82[.]225.

Coding Errors Prevented Remote Access

Despite successfully deploying persistence mechanisms and exfiltrating reconnaissance data, coding errors within the malware's routines prevented attackers from gaining remote access. On macOS, the malware checked remote login status using systemsetup without elevated privileges, triggering an error and skipping activation. On Windows, it attempted to start OpenSSH via /bin/sh, a Unix shell absent on standard Windows installations.

Even though the SSH setup failed on unconfigured machines, the malware still successfully installed backdoor keys and transmitted telemetry data. Researchers noted that the script did not directly steal local credentials, implying that attackers intended to manually retrieve sensitive information after securing remote SSH access.

Remediation and Industry Impact

Cursor promptly removed the malicious extension and temporarily disabled its entire marketplace to conduct security audits and rotate access keys. Working alongside hosting providers, the company took the attacker's server offline to disrupt reverse connections. Internal investigations confirmed that no other extension versions or official distribution channels were compromised.

Developers who downloaded packages during the exposure window are advised to check for an 'svc-telemetry' SSH key on their systems. If affected, users should isolate the machine, rotate security secrets, invalidate active sessions, and rebuild environments from secure backups. Questions regarding how threat actors published a package under Anthropic's name remain under investigation.