Tampered Claude Code extension on Cursor planted an SSH backdoor
Original title: Anthropic: That Claude Code extension compromise… couldn't be us
Version 2.1.313 was downloadable for about 11 hours and could have reached up to 5,000 developers; official Anthropic channels were not affected.
A malicious copy of the official Claude Code extension was published on Cursor’s marketplace and installed a persistent SSH backdoor for Windows, macOS, and Linux. Anthropic staff member Felix Rieseberg said the package was not built or published by Anthropic and that Anthropic systems and employee laptops were not compromised. Cursor said version 2.1.313 was available from 0227 to 1335 PT on Thursday, then removed it, shut down the VS Code marketplace, rotated keys, and blocked the attacker’s server.
Unconfirmed: Neither Cursor nor Anthropic has said how the tampered package reached the official marketplace.
- Phorion first spotted the tampered Visual Studio Code extension update.
- The implant collected usernames, Git emails, and public IP addresses.
- The reverse SSH tunnel usually failed because it needed admin rights.
- The extension still sent host data, dropped an SSH key, and installed persistence.
- Installing the latest version does not remove the persistence mechanism.
Impact: Host and user data theft plus a persistent SSH backdoor
| Product | Affected |
|---|---|
| Anthropic Claude Code extension for Cursor | 2.1.313 |
- 1.Follow Cursor’s remediation steps and use its cleanup scripts.
- 2.Hunt for the dropped SSH key and persistence even after updating.
- 3.Treat only Cursor users of the tampered extension as affected.
- Products
- Claude Code
- Organizations
- Phorion
From the original article
2 min read at theregister.comClaudeshop fingers 'malicious actor' in targeted supply-chain attack on Cursor
By Connor Jones · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.