Tampered Claude Code Extension in Cursor's Marketplace Tried to Plant an SSH Backdoor

Cursor has disclosed that on October 29 a maliciously modified version of the Claude Code add-on was circulating in its extension store. The code loaded together with the extension and tried to set up a persistent SSH backdoor on developers' machines. According to Cursor, the tampered package did not come from Anthropic.

What happened

According to BleepingComputer's report, Cursor said Anthropic did not create the malicious version 2.1.313 of the Claude Code extension. The company has not explained, however, how the attackers distributed it under Anthropic's name. For about 11 hours it could have been downloaded by users of the editor. Cursor warned: "The extension runs malicious code that attempts to install a persistent SSH backdoor."

Early reports also mentioned npm, Open VSX and Microsoft's marketplace for VS Code, but later findings ruled those channels out. Cursor's store was the only source of the malicious version. As of publication, BleepingComputer had received no response from Cursor or Anthropic to its follow-up questions.

The extension runs malicious code that attempts to install a persistent SSH backdoor. - Cursor, warning to users

How the code worked

Researchers at Phorion and OpenSourceMalware found a malicious JavaScript loader at the beginning of the extension.js file. The rest of the extension's code was left unchanged. The loader ran when the extension loaded and did not require the user to interact with Claude Code.

It collected system and user information, including the Git email address and public IP address. It then added an attacker-controlled key to the SSH configuration, tried to enable the SSH service and attempted to set up a reverse tunnel. Persistence came from a LaunchAgent on macOS or a scheduled task or Startup script on Windows, retried roughly once a minute. Host details and backdoor status were sent to the address 134.209.82[.]225.

According to Phorion, the code contained bugs. On macOS, the check of the Remote Login status ran without elevated privileges and returned an error, so enabling SSH was skipped. On Windows, the attempt to install OpenSSH through PowerShell went via /bin/sh, which is not normally present there, so it failed. The keys, persistence and tunnel attempts still ran, but access failed if SSH had not already been running.

Cursor's response

Cursor removed the extension, temporarily shut down the whole marketplace, audited other extensions and rotated all access keys. Together with the hosting provider, it got the attackers' server taken offline, which cut the reverse SSH connections and data exfiltration. According to Cursor, an internal investigation found no sign that other extension versions or the official distribution were affected.

It remains an open question how the attackers published a package under Anthropic's name in Cursor's store and whether Cursor's or Anthropic's systems were breached. BleepingComputer notes that the code does not directly steal credentials, even though it collects the names of environment variables associated with credentials. This suggests the attackers planned to gather data manually at a later step.

What to do if infected

Anyone who downloaded the package during the window should check for an SSH key named "svc-telemetry" and, if infection is confirmed, follow Cursor's remediation instructions. For compromised machines, the recommendation is to isolate them, rotate accessible secrets, invalidate sessions and rebuild from safe backups.

For development teams in Poland, this is another sign that extension stores for AI-powered editors are an attack vector against developer workstations, which often hold keys to repositories and the cloud. It is worth checking whether anyone at the company installed or updated to version 2.1.313 in Cursor during that window.