Trojanized Claude Code Extension Targets Cursor Marketplace Users
Malicious update installs persistent SSH backdoors on developer systems via compromised extension package.
1Compromised Extension Distribution
A trojanized version of Anthropic's Claude Code extension, labeled 2.1.313, was distributed through the Cursor Marketplace. This malicious package utilized the legitimate publisher identity to deceive users. Cursor temporarily shut down its marketplace to address the incident, which impacted approximately 5,000 users who installed the update between 2:27 a.m. and 1:35 p.m. PT.
2Malicious Payload Mechanics
The malicious bundle contained a 66-line loader inserted before the legitimate code. Upon activation, the extension attempts to append an attacker-controlled SSH key labeled svc-telemetry to the user's authorized_keys file. It further establishes a reverse tunnel to 134.209.82.225 and transmits host reconnaissance data via unencrypted HTTP requests on port 8099.
3Persistence and Platform Impact
The malware installs platform-specific persistence mechanisms, including scheduled tasks on Windows, crontabs on Linux, and LaunchAgents on macOS. While the extension attempts to activate local SSH services, Cursor notes that this step often fails on systems lacking administrative privileges. However, the persistence and host data exfiltration remain active regardless of SSH success.
4Scope of the Breach
The incident was isolated to the Cursor Marketplace, with no evidence of compromise affecting Microsoft's official VS Code Marketplace or the Open VSX registry. Anthropic has since released version 2.1.314 to these secure platforms. Users who installed the extension through Cursor during the specified window are the only ones confirmed to be affected.
5Risk of Credential Exposure
Security researcher Paul McCarty noted that while initial beacons do not contain direct environment variables, the metadata revealed can expose cloud providers, CI systems, and configured credential types. Successful SSH access would grant the operator direct account inspection capabilities. No secondary payloads have been observed, but the reverse tunnel remains a significant threat.
6Required Remediation Steps
Impacted users must immediately isolate affected hosts to prevent further unauthorized access. Necessary actions include removing the unauthorized SSH key, deleting persistence mechanisms like LaunchAgents or scheduled tasks, and rotating all credentials and sessions. Cursor is currently reaching out directly to the 5,000 users identified as having installed the compromised version.
7Broader Supply Chain Context
This event follows a similar security incident involving the hijacking of a legitimate contributor's GitHub account to distribute malware via OVHcloud's official CLI binaries. These incidents highlight the growing trend of attackers targeting developer ecosystems and IDE marketplaces to deploy secret-stealing malware, necessitating heightened vigilance regarding automated extension updates and package integrity.
8Strategic Security Implications
The incident underscores the vulnerability of IDE marketplaces to supply chain attacks. Developers relying on auto-update features face increased risks when marketplace governance is bypassed. Organizations must prioritize identity visibility and attack surface monitoring to detect hidden threats within their development environments, ensuring that AI-integrated tools do not become vectors for persistent unauthorized access.