SMAR Daily Industry News

Cursor pulls malicious Claude Code extension after SSH backdoor

Cursor removed two compromised versions of the Claude Code extension, 2.1.312 and 2.1.313, from its VS Code Extension Marketplace after they were available for roughly 11 hours on October 29. The maliciously modified extensions attempted to add an attacker-controlled SSH key, enable local SSH access, and create a reverse tunnel to an external server, potentially giving attackers remote access to developers' machines that store source code, credentials and other sensitive data.

The malicious code was inserted at the start of the extension's JavaScript file and executed automatically when the extension loaded, requiring no user interaction. It tried to write an SSH key to the user's authorized_keys file and set up persistence through scripts and startup entries. On macOS, the malware attempted to verify whether Remote Login was disabled using a privileged command; lacking admin rights, the command failed and the SSH enable step was skipped. On Windows, an error in the code could prevent the SSH service setup command from running correctly.

Security firm Phorion performed the initial analysis, while Microsoft Threat Intelligence later reported that the malware collected machine names, usernames, operating systems, working directories, and Git email addresses. It also scanned environment variables for names containing terms such as KEY, TOKEN, SECRET, PASS, AWS, or GCP, logging up to forty matches but not the variable values themselves. Anthropic clarified that the tampered extensions were not produced by its team and that its official channels remain unaffected. Felix Rieseberg, a technical staff member at Anthropic, said the incident stemmed from a malicious actor exploiting access to Cursor's marketplace, not a compromise of Anthropic's systems or employee devices.

Cursor's notice indicated that enabling the local SSH service would generally fail without administrator privileges on affected Windows machines, suggesting that the backdoor might not fully activate in all cases. Nonetheless, the presence of the malicious extension underscores the risk of supply-chain attacks in developer tool ecosystems.

Why it matters

Developers using third-party extension marketplaces face heightened risk of supply-chain attacks that can expose code and credentials.

FAQ

Which versions of the Claude Code extension were compromised?
Versions 2.1.312 and 2.1.313 were the maliciously modified releases.

How long were the malicious extensions available in Cursor's marketplace?
They were available for approximately 11 hours on October 29.

Did the malicious code require user interaction to execute?
No, the payload ran automatically when the extension loaded.

What data did the malware attempt to collect?
It gathered machine names, usernames, operating systems, working directories, Git email addresses, and environment-variable names containing terms like KEY, TOKEN, SECRET, PASS, AWS, or GCP.

Source: InfoWorld. See the original source for full details.