Overview
Tampered copies of the anthropic.claude-code extension were served through Cursor's VS Code extension marketplace, according to SecurityWeek. The malicious builds, versions 2.1.312 and 2.1.313, were live for roughly 11 hours starting October 29.
Anthropic said it did not build or publish the tampered copies and has released its legitimate update as 2.1.314. The malicious versions were reportedly not pushed to the Microsoft Visual Studio Marketplace, Open VSX or npm.
What the payload did
- Ran JavaScript on module load to collect host details: hostname, username, OS, architecture, working directory and global Git email
- Attempted to install an SSH key, enable SSH and open a reverse SSH tunnel
- Set up persistence through platform-specific scripts and startup configuration on macOS and Windows
- Sent host details out through a delayed callback
Cursor says enabling SSH requires administrator rights the extension usually lacks, so that step likely failed and attackers probably could not log in through the tunnel. Persistence scripts, however, may still be running.
Scale
Security researcher Kevin Beaumont estimated that about 5,000 developer systems may have downloaded the tampered versions. Microsoft published analysis describing a persistent SSH backdoor.
Cursor's response
- Removed the modified extension and suspended the marketplace
- Found no other malicious extensions
- Rotated all keys, rebuilt and reopened the marketplace
- Worked with the hosting provider to take the attacker's server offline
- Published a security notice, a detection script and indicators of compromise
What to do
- Check whether Claude Code 2.1.312 or 2.1.313 was installed in Cursor between October 29 and 30.
- Run Cursor's detection script and consult its published IoCs.
- Isolate any host showing signs of payload execution; remove the unauthorized SSH key, persistence scripts and tunnel processes.
- Uninstalling the extension alone is not enough, because the payload drops standalone persistence. Decide whether the machine should be rebuilt.
- Rotate credentials and tokens present on affected developer machines.
Takeaway
Editor extensions run with the full privileges of the developer and are a high-value supply chain target. Pin extension versions where possible, restrict marketplaces in managed environments, and monitor developer endpoints for unexpected SSH configuration changes.