Tampered Claude Code extension creates SSH backdoor for 5,000 users

The Mechanics of the Backdoor

The malicious version of the Claude Code extension, identified as build 2.1.313, was designed to grant remote access to an attacker's server. It functioned by attempting to add a specific SSH key to the victim's machine and then enabling the local SSH service. This combination allowed for a reverse tunnel, which is a method where the victim's computer initiates a connection to an outside server to let the outsider connect back in.

According to reports from Northeast Times, the malware was designed to be automated and persistent. It ran as soon as the Node environment loaded the file, meaning users did not have to perform any specific actions to be infected. To ensure the connection remained active after a computer was turned off, the script created hidden startup files on macOS, cron entries on Linux, and a scheduled task named SysMon on Windows.

The script also attempted to maintain the connection by retrying every 60 seconds. While some coding errors blunted the attack's effectiveness on macOS—specifically a faulty check that often prevented the SSH service from turning on—the threat remained significant. Phorion CEO Calum Hall noted that any Mac with Remote Login already enabled would still be vulnerable to the backdoor.

Data Exfiltration and Targeting

Beyond providing a doorway for remote access, the tampered extension acted as a reconnaissance tool for the attackers. It automatically sent a variety of system details back to the attacker's server, including the machine's hostname, username, operating system, and public IP address. It also gathered information about the user's home and working directories, as well as their Git email address.

The extension specifically looked for sensitive information by listing up to 40 environment variables that appeared to be keys, tokens, or cloud credentials. While the actual values of these secrets remained on the victim's machine, the names provided a roadmap for attackers. This allowed them to identify which specific computers held the most valuable secrets worth targeting for a follow-up attack.

This level of automated data collection shows a sophisticated approach to targeting developers. By identifying the presence of cloud credentials and specific working directories, the attackers could prioritize high-value targets within a larger organization. The goal was to create a persistent foothold while simultaneously mapping out the most lucrative targets for further exploitation.

How the Extension Spread

The malicious build was distributed through the official account for Anthropic on the Cursor marketplace. Neither Cursor nor Anthropic has yet explained how the attackers managed to gain access to the marketplace to publish the tampered copy. Anthropic has officially stated that their own systems and employee laptops were not compromised during this event.

Felix Rieseberg, a member of Anthropic's technical staff, clarified that the company is working with Cursor but did not build or publish the bad version. Early reports suggested the compromise might have occurred on Open VSX, an open-source registry used by editors like Cursor and Windsurf. However, Ax Sharma of Manifold Security has disputed the reports that the Open VSX version was actually compromised.

The tampered build remained available for about 11 hours before it was identified and removed. While the marketplace is now back online, the incident highlights a vulnerability in how third-party extensions are verified and distributed. The fact that a malicious build could sit in an official marketplace for half a day underscores the risks inherent in the current extension ecosystem.

Remediation and Next Steps

Cursor has taken several steps to contain the damage, including removing the backdoored version and taking its marketplace offline temporarily. They worked with the cloud provider hosting the attacker's server to ensure infected machines could no longer reach it. The company also rotated its keys and audited its access to ensure no other tampered extensions remained in the registry.

For users who were affected, simply updating to the newer version (2.1.314) is not enough to clean the system. Because the malware created persistence files, infected machines may still harbor the attacker's SSH key and startup tasks. Users who installed version 2.1.313 are advised to manually check for the attacker's public-key fingerprint and delete any unauthorized startup files.

Security experts recommend that affected developers rotate all credentials that may have been exposed. This includes any cloud tokens, environment variables, or SSH keys that were listed on the system. Because the attackers had a window of time to see which machines held secrets, any credentials on an affected machine should be considered potentially compromised.