Cursor shuts marketplace after malicious Claude Code extension

The Marketplace Breach

The AI-powered coding platform Cursor recently discovered a security incident involving a malicious version of Anthropic’s Claude Code extension. This tampered package was distributed through Cursor’s integrated marketplace, which serves as a hub for developers to find and install various tools. The company took the marketplace offline on October 30 to investigate the breach and neutralize the threat.

According to News Karnataka, the malicious extension was not developed by Anthropic and was not published through official channels like the npm registry. It appeared on the Cursor marketplace on October 29 and remained available for several hours. During this window, up to 5,000 users may have downloaded or received the compromised software package.

Cursor has since restored the marketplace after auditing the available extensions and finding no other affected packages. The company also rotated its security keys and blocked the attacker's connection to the server hosting the malicious software. They clarified that the incident did not impact other products like Grok or Grok Bot.

How the Malware Operated

Security researchers from Microsoft analyzed the malicious extension and found it was designed to execute JavaScript code upon loading. This code attempted to gather sensitive information about the victim's computer, including the operating system, hostname, and public IP address. It also sought to establish a backdoor by installing an attacker-controlled SSH key.

SSH (Secure Shell) is a standard technology that allows developers to access and manage computers remotely. By installing a private key, an attacker could potentially connect to a user's machine without permission. The malware also tried to establish a reverse SSH connection to maintain communication between the infected device and an attacker-controlled server.

To ensure the malware survived a system reboot, it included mechanisms to create startup entries on Windows, macOS, and Linux systems. It was also programmed to transmit the collected system information to a remote server at regular intervals. However, the success of these actions depended on specific factors like the user's administrator permissions and the attacker's server configuration.

Limitations on the Damage

While the malware was designed to create a persistent backdoor, researchers identified a flaw in its operation that may have limited its effectiveness. This weakness meant that the malware struggled to establish persistent access on the majority of the systems it targeted. Some actions, such as enabling SSH access, may have failed simply because the extension lacked the necessary privileges on many machines.

Despite these limitations, security experts warn that users who installed the extension cannot assume their devices are completely safe. The malicious code could still have successfully collected some system information or created files on the hard drive. Because the malware was designed to write files outside of the extension's installation directory, simply updating the software might not remove the threat.

Security researchers are advising affected users to perform a manual investigation of their systems rather than relying on a clean update. This includes looking for unfamiliar entries in authorization files or suspicious startup scripts. Organizations are encouraged to preserve system evidence before cleaning machines to help understand the full scope of the intrusion.

Remediation and Next Steps

Cursor has instructed all customers to update the Claude Code for VS Code extension to version 2.1.314. However, the company emphasizes that this update is only a first step for those who may have interacted with the malicious version. Users are encouraged to review official security guidance to ensure their environments are properly secured.

Microsoft has outlined specific checks for affected developers, such as inspecting SSH authorization files for unfamiliar keys. They also recommend reviewing system activity for unexpected network traffic or unfamiliar processes. If a device shows clear signs of compromise, security teams may need to isolate the machine and consider rebuilding the environment from a known-clean backup.

The incident leaves several questions regarding how the attacker obtained the ability to publish the modified package under Anthropic’s identity. Cursor has not yet publicly explained the specific route the attacker took to bypass marketplace protections. This event underscores the growing importance of securing extension ecosystems as AI-powered coding tools become standard in the software development lifecycle.