A malicious version of Anthropic’s Claude Code VS Code extension was distributed through Cursor’s extension marketplace for roughly 11 hours on October 29, potentially exposing up to 5,000 developers to malware designed to install persistent SSH backdoors.

The tampered package, labeled version 2.1.313, was available between 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor is an AI-powered code editor built on Microsoft’s open-source VS Code, and it supports the same extensions. Anthropic’s Claude Code extension integrates its AI coding assistant directly into compatible editors. Cursor says Anthropic did not create the malicious extension, and the company has not explained how attackers managed to distribute the compromised package under Anthropic’s legitimate publisher identity.

How the backdoor worked

Researchers at Phorion and OpenSourceMalware found that attackers inserted a malicious JavaScript loader at the start of the extension’s extension.js file, leaving the rest of the legitimate code untouched. The malicious code ran automatically when the extension loaded, requiring no user interaction.

  • Collected system and user information, including Git email and public IP address
  • Added an attacker-controlled SSH key and attempted to enable SSH access with a reverse tunnel
  • Installed persistence via a macOS LaunchAgent or a Windows scheduled task/Startup script, retrying the tunnel roughly every minute
  • Sent host details and backdoor status to an attacker server at 134.209.82[.]225

Coding errors blunted the attack

According to Phorion, bugs in the malware’s SSH setup routines likely prevented attackers from gaining remote access to many affected Windows and macOS systems. On macOS, the malware checked Remote Login status using systemsetup -getremotelogin without elevated privileges, causing it to return an access error rather than the actual status and skip activation. On Windows, the malware tried to install OpenSSH via PowerShell but attempted to invoke it through /bin/sh, a Unix shell unavailable on standard Windows systems, causing the setup to fail.

In both cases, the malware could still install SSH keys, establish persistence, and attempt the reverse tunnel, but without an active SSH server, the tunnel could not actually deliver remote access. Even when the backdoor failed, the malware still exfiltrated reconnaissance data, including username, hostname, public IP, Git email, and names of environment variables tied to sensitive credentials, though it did not directly steal credential values, suggesting attackers planned to harvest data manually after gaining SSH access.

Response and remediation

Cursor removed the malicious extension, temporarily shut down its entire marketplace to audit other extensions, and rotated all access keys before restoring service. The company also worked with the hosting provider to take the attacker’s server offline, cutting off both reverse SSH connections and reconnaissance data transmission. Cursor’s internal investigation found no evidence that other extension versions or Anthropic’s official distribution channel were affected.

Developers who installed the package during the exposure window should check for an ‘svc-telemetry’ SSH key on their machines and follow Cursor’s remediation guidance if compromise is confirmed. Affected machines should be isolated pending investigation.