A malicious version of Anthropic’s Claude Code VS Code extension was distributed through Cursor’s extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.
The extension used the version number 2.1.313 and was distributed between 2:27 a.m. and 1:35 p.m. Pacific Time.
Cursor states Anthropic did not develop the malicious extension and has not explained how attackers distributed the compromised package under Anthropic's name.
- The attacker-supplied package appeared in Cursor’s VS Code marketplace, not in npm, Open VSX, or Microsoft’s VS Code Marketplace according to Cursor’s later statements.
WHAT THE MALWARE DID ONCE LOADED
Researchers found a malicious JavaScript loader at the beginning of the extension’s extension.js file, leaving legitimate extension code unchanged.
The malware collects system and user information, adds an attacker-controlled SSH key, and attempts to enable SSH access and establish a reverse tunnel.
Persistence is attempted via a macOS LaunchAgent or Windows startup script, with a retry cadence of about once per minute.
Even if SSH setup failed, the script continued to send host details and backdoor status to the attacker’s server at the obfuscated IP 134.209.82[.]225.
- In macOS, Remote Login checks and privilege issues can prevent activation of SSH; in Windows, attempts to install and start OpenSSH via a Unix shell (not present on standard Windows) also hinder SSH setup.
WHAT REMAINS UNCERTAIN AND WHY IT MATTERS
Cursor reports Anthropic did not develop the malicious extension and notes uncertainty around how the compromise was carried out in the marketplace.
Some reports initially linked other marketplaces (npm, Open VSX, VS Code Marketplace) but Cursor later indicated it was the sole source involved in distributing the malicious package.
The broader supply-chain question—whether Anthropic or Cursor systems were compromised—remains unresolved in the available sources.
- Researchers observed that the backdoor could still send reconnaissance data even when SSH activation failed, highlighting data-exfiltration risks beyond remote access."
REMEDIATION AND GUIDANCE FOR READERS
For affected hosts, isolate them, rotate accessible secrets, invalidate sessions, and rebuild affected environments from safe backups as recommended by the reporting sources.
Cursor’s security notice provides remediation scripts and steps to remove unauthorized keys and payloads (remediate-macos.sh for macOS and remediate-windows.ps1 for Windows). Cursor also notes it rotated keys, rebuilt the marketplace, and brought it back online after the incident.
The malicious extension appended the attacker’s public key (svc-telemetry) to SSH authorized_keys; checking for this key is part of remediation guidance.
- Check for the presence of the attacker-provided SSH key (svc-telemetry) in ~/.ssh/authorized_keys on Unix-like systems and corresponding locations on Windows.
- Rotate credentials and sessions, and consider rebuilding affected environments from trusted backups. Cursor’s remediation scripts are available to help remove the payload and persistence mechanisms.
RELATED COVERAGE
- CISOs weigh vulnerability risk management in the AI era
- Microsoft Security Blog publishes threat matrix for cloud web applications
- Post-quantum authentication: Why organizations should start testing certificate ecosystems now
- Storm-3168: Agentic-driven cloud attacks hinge on compromised service principals, Microsoft Security Blog reports
- Security articles
