Cursor removes malicious Claude Code extension after SSH backdoor attempt
A malicious version of the Claude Code extension distributed through the Cursor marketplace for 11 hours installed SSH backdoors on developer machines.
A maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code Extension Marketplace between about 2:27am PT and 1:35pm PT on October 29. Cursor removed the compromised versions 2.1.312 and 2.1.313 after discovering they had been available for approximately 11 hours. The malicious code attempted to add an attacker-controlled SSH key, enable local SSH access, and establish a reverse tunnel to an attacker-controlled server. The malware ran as soon as the extension loaded before its normal activation code and created scripts and startup entries to keep the connection available after a system restart. Cursor temporarily shut down its marketplace, audited access, rotated keys, and rebuilt the marketplace before restoring the service.
Unconfirmed: The malicious actor had used access to Cursor’s marketplace
- Malicious versions 2.1.312 and 2.1.313 available for 11 hours
- Malware added attacker-controlled SSH key and installed persistence
- Affected Windows and macOS users
- Malware ran without user interaction
- Anthropic systems not compromised
Impact: Installation of SSH backdoor giving remote access to systems and credentials
- 1.Remove the malicious extension
- 2.Check authorized SSH keys
- 3.Rotate potentially exposed credentials
- Products
- Claude Code extension
From the original article
3 min read at csoonline.com
A malicious version of Anthropic’s Claude Code extension distributed through the Cursor marketplace attempted to install a persistent Secure Shell (SSH) backdoor on developers’ machines, potentially giving attackers remote access to systems holding source code, credentials and other sensitive information.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.