Malicious Claude Code extension targets 5,000 Cursor users

The Cursor Marketplace Breach

A supply chain attack recently targeted users of Cursor, a popular code editor. A malicious version of Anthropic’s Claude Code extension was published on the Cursor VS Code Extension Marketplace, where it remained live for about 11 hours on October 29. This specific incident targeted both macOS and Windows users who were looking to integrate Anthropic's AI tools into their development workflows.

The compromised versions were identified as 2.1.312 and 2.1.313 of the anthropic.claude-code extension. Crucially, these versions were not produced by Anthropic and were not distributed through official channels like the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry. Instead, a malicious actor used unauthorized access to the Cursor marketplace to inject the tampered code.

Anthropic clarified that their official distribution channels remained unaffected throughout the incident. To prevent further confusion among the developer community, Anthropic updated their legitimate extension to version 2.1.314. This move ensures that users who download from official sources are not interacting with the compromised code used in the Cursor marketplace breach.

How the malware functioned

The malicious extension utilized JavaScript code that triggered automatically when modules were loaded. Its primary objective was to establish a reverse SSH tunnel, which is a method for an external attacker to gain remote access to a private computer. By creating this tunnel, an attacker could potentially bypass firewalls to interact with the victim's machine as if they were logged in locally.

Before establishing the tunnel, the code performed reconnaissance to gather specific details about the host system. It collected data such as the hostname, username, operating system, system architecture, and the global Git email address. It also looked for the current working directory to understand the user's environment and project structure. This information is highly valuable for attackers looking to move laterally through a network.

Beyond simple data collection, the script was designed to modify files and execute various OS commands. It attempted to install an SSH key, enable the SSH service, and configure persistence mechanisms. Persistence refers to techniques that allow a piece of malware to remain active and restart automatically even if the system is rebooted or the initial process is closed.

Impact on developer systems

Security researcher Kevin Beaumont estimated that roughly 5,000 developer systems may have downloaded the malicious versions during the 11-hour window. While the scope of the infection is significant, the attackers faced a technical hurdle regarding permissions. Because enabling a local SSH service typically requires administrative privileges, the attack failed on most macOS and Windows systems where the extension lacked those rights.

Despite the failure to establish a full login tunnel, the extension still successfully executed several actions. It was able to run platform-specific scripts and deploy startup configurations. This means that even if the attackers couldn't log in directly, they may have successfully planted scripts that could run in the background or exfiltrate specific pieces of information from the user's environment.

Cursor responded quickly to the discovery by removing the extension and suspending the marketplace to conduct a full investigation. They rotated all security keys and rebuilt the marketplace before reopening it. They also coordinated with the cloud provider hosting the attacker's server to take that infrastructure offline, cutting off the potential communication path for the malware.

Remediation and next steps

For users who may have downloaded the affected versions, simply uninstalling the extension is not enough to secure the system. Cursor warned that the payload drops standalone persistence scripts that continue to run independently of the extension. Users are encouraged to use the detection script provided by Cursor to identify any signs of infection or unauthorized backdoors on their machines.

If an infection is confirmed, the recommended course of action involves isolating the host from the network. Users should look for and remove unauthorized SSH keys, persistence mechanisms, and any active tunnel processes. In many cases, Cursor suggests that the most secure way to ensure a system is clean is to rebuild the host entirely rather than attempting to manually scrub every script.

Moving forward, this incident serves as a reminder of the risks inherent in third-party marketplaces. Developers should remain vigilant about the source of their tools and monitor their systems for unusual activity. The security community will likely watch for further details on how the attacker gained the initial access to the Cursor marketplace to prevent similar breaches in the future.