Malicious Claude Code Extension in Cursor Marketplace Tried to Plant SSH Backdoor

The compromised Claude Code extension in Cursor’s marketplace shows how a routine developer tool update can reach sensitive systems before anyone interacts with it. Versions 2.1.312 and 2.1.313 attempted to plant an SSH backdoor and send information about affected machines to an attacker.

Cursor said the versions were available for about 11 hours on October 29, from approximately 2:27 a.m. to 1:35 p.m. PT. The company removed them after discovering the tampering. The affected releases were listed for Windows and macOS.

Anthropic said its own systems and employee laptops weren’t compromised. Felix Rieseberg, a member of Anthropic’s technical staff, said in a post on X that an attacker used access to Cursor’s marketplace to publish the altered extension. Anthropic’s official distribution channels weren’t affected, he said, and the company was working with Cursor. Cursor’s security notice also stressed that Anthropic hadn’t developed the malicious versions.

Payload ran when the extension loaded

Analysis by security company Phorion found malicious JavaScript inserted at the start of the extension’s file, ahead of its normal activation code. That placement meant the payload could run as soon as the extension loaded. “The user doesn’t need to interact with the extension for the payload to fire,” Phorion reported.

The code tried to add an attacker-controlled key to the user’s authorized_keys file, enable local SSH access and open a reverse tunnel to a remote server. It also created scripts and startup entries intended to keep access available after a reboot.

Phorion found execution flaws in both operating systems’ code. On macOS, a command used to check Remote Login required administrator privileges. Without them, the command returned an access error, and the malware skipped its attempt to enable SSH. On Windows, an error could stop the command that set up the SSH service.

Those failures didn’t prevent every part of the attack. Cursor said enabling SSH would generally fail without administrator access on affected machines, but the extension could still add the key, install persistence mechanisms and transmit host information.

Uninstalling may leave access behind

Microsoft Threat Intelligence’s analysis said the malware collected machine names, usernames, operating systems, working directories and Git email addresses. It also searched environment variable names for terms such as KEY, TOKEN, SECRET, PASS, AWS and GCP, recording up to 40 matches. Microsoft said it collected the matching names, not their values.

Cursor warned that removing the extension might leave components behind because the malware placed scripts outside its installation directory. Steve Povolny, Exabeam’s vice president of AI strategy and security research, described the cleanup risk this way: “Removing the extension only sends the visitor away while the spare key stays on the hook.”

Povolny recommended checking authorized SSH keys on machines accessible to affected developers, rotating credentials that may have been exposed, and reviewing logs for logins using unfamiliar keys. Phorion advised verifying the key’s fingerprint rather than relying on its attached comment, svc-telemetry.

Marketplace trust becomes a supply chain question

Yash Kadakia, founder and CTO of Security Brigade, said companies should treat extension marketplaces as part of their software supply chain. A malicious update distributed through a familiar marketplace can undermine the assumption that a trusted source guarantees a safe package, he said.

Kadakia recommended verifying publishers and package integrity, limiting which extensions and versions developers can install, and using allowlists, controlled updates and endpoint monitoring. Restricting outbound connections, using short-lived credentials, separating development environments and limiting access to sensitive infrastructure can also reduce the reach of a compromised workstation.

Cursor said it temporarily shut down its marketplace, audited access, rotated keys and rebuilt the service before restoring it. For teams reviewing exposure, the key operational point is that removing a compromised extension is only the first step: persistence files, SSH keys and account activity also need attention.