Tampered Claude Code extension targets 5,000 users with SSH backdoor

The marketplace compromise

A security incident occurred when a tampered version of Anthropic’s Claude Code extension appeared in the Cursor IDE extension marketplace. The malicious software was live for about 11 hours on Thursday, October 29, reaching as many as 5,000 users. Cursor, the company that owns the IDE, issued a notice explaining that the affected versions were 2.1.312 and 2.1.313 for both Windows and macOS.

Security researchers from the firm Phorion flagged the issue, noting that the tampered extension was posted to the official Anthropic account on the Cursor marketplace. This allowed the malicious version to effectively supersede the legitimate version. Because Cursor updates extensions automatically by default, many users may have received the compromised code without manual intervention.

Neither Anthropic nor Cursor has disclosed exactly how the attacker gained access to the distribution channel. However, Anthropic clarified that the incident was not a breach of their own internal systems or employee laptops. They emphasized that they did not build or publish the specific version that contained the malicious code.

How the malware functioned

The tampered extension was designed to perform several malicious actions on a developer's machine. It first collected specific details about the user and the computer, such as the hostname, username, Git email, and public IP address. It then attempted to plant an SSH backdoor by adding the attacker's key and enabling the computer's SSH service.

The malware also tried to establish a reverse tunnel to a server controlled by the attacker. While this specific step usually requires administrator rights, the extension lacked those permissions on most machines. This means the tunnel might have failed, but the persistence scripts and the initial data upload were still successful.

Additionally, the malware targeted sensitive development information by sending the names of up to 40 environment variables. These variables matched keys, tokens, and secrets, though the malware did not capture the actual values. This provides an attacker with a map of which cloud credentials and secrets are stored on a developer's machine.

Impact on developers

The scope of the incident is limited to users of the Cursor IDE who downloaded the Claude Code extension from their specific marketplace. Cursor confirmed that other products, such as Grok Bot or other SpaceXSI products, were not impacted. They also noted that extensions downloaded from other sources were not affected by this specific incident.

Because the malware installed persistence scripts, simply uninstalling the extension may not be sufficient to remove the threat. Users who were affected need to follow specific instructions to identify the malicious package and mitigate the impact. Cursor has provided scripts to help users check for and remove the remaining backdoor components.

The incident serves as a reminder of the risks associated with supply-chain attacks on developer tools. Researchers have previously warned that the growing popularity of AI coding tools could make them attractive targets for such attacks. Attackers can use these tools to reach a wide audience of developers who have high-level access to sensitive codebases.

Response and remediation

In response to the discovery, Cursor took down its entire extension marketplace to inspect all available tools. They worked with relevant providers to neutralize the malware and rotated their security keys before reopening the marketplace. They also successfully took the attacker's server offline to stop the flow of data.

Cursor has instructed all customers to update to Claude Code for VS Code version 2.1.314, which is a clean version. They have published a blog post containing specific instructions for users who may have been impacted. These instructions help users understand how to find the malicious package and secure their machines.

Anthropic continues to work with Cursor on the incident to ensure the security of the ecosystem. While the official channels for Anthropic remain unaffected, the incident highlights the importance of monitoring third-party marketplaces. Developers are encouraged to stay vigilant when installing new extensions that interact with their local environments.