Malicious Claude Code extensions in Cursor marketplace planted SSH backdoor

For about 11 hours on October 29, maliciously modified versions of Anthropic’s Claude Code extension were available through Cursor’s VS Code Extension Marketplace. The packages attempted to install a persistent SSH backdoor on developers’ computers. The affected releases were Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS. Cursor said Anthropic did not develop them.

Developers who installed or updated either version from Cursor’s marketplace between about 09:27 and 20:35 UTC should not rely on uninstalling the extension. In its security notice and remediation guidance, Cursor said the payload left standalone scripts and tunnel processes behind. The company advised isolating hosts showing evidence of execution, removing the unauthorized SSH key and persistence, assessing whether to rebuild the host, and using a trusted system to rotate credentials and sessions accessible from the machine.

The injected code appended an attacker-controlled public key to the user’s authorized_keys file, tried to turn on the local SSH service, and opened a reverse SSH tunnel to an attacker-controlled server. A reverse tunnel is an outbound connection that lets an operator route traffic back to the affected computer’s SSH service. The payload tried to keep that tunnel running through a macOS LaunchAgent or a Windows SYSTEM scheduled task with a Startup-folder fallback, retrying roughly every 60 seconds.

The malware also sent host and user details to the attacker, including the hostname, username, operating system, architecture, home and working-directory paths, configured Git email and public IP. It collected the names, but not the values, of selected environment variables.

Cursor said coding errors and a lack of administrator rights meant the attempt to enable SSH would fail on most Windows and macOS hosts. That could prevent an attacker from logging in through the tunnel when SSH was not already active, but it did not stop the payload from planting its key, creating persistence or sending host details. The opened sources do not establish whether an attacker successfully logged into any affected host or used the access for follow-on activity.

Cursor removed the packages, blocked further distribution and temporarily shut down the marketplace. It said it audited access, rotated keys, rebuilt the marketplace and restored service. The company also worked with the hosting provider to take the attacker server offline, disabling the tunnel and host-detail endpoint identified in the notice.

Cursor has not publicly explained how the modified packages entered its marketplace or how the relevant publishing access was compromised. Its notice gives no install count or confirmed affected-host count. Cursor said it had no evidence that other Claude Code extension versions or Anthropic’s official distribution were affected. Its audit found no other marketplace extensions had been tampered with.