Tampered Claude Code Extension Compromises Cursor IDE Users
Malicious extension update exposes developer credentials and attempts SSH backdoor installation.
1Malicious Extension Distribution
On October 29, 2024, a tampered version of the Claude Code extension appeared on the Cursor marketplace. Active for approximately 11 hours, the malicious code reached up to 5,000 users. The compromised versions, specifically 2.1.312 and 2.1.313, were distributed through the official Anthropic account, bypassing standard verification protocols for developers.
2Attack Mechanism and Scope
The malware harvested sensitive machine data, including hostnames, usernames, Git emails, and public IP addresses. It attempted to inject an SSH backdoor and establish a reverse tunnel to an attacker-controlled server. Additionally, the script scanned for 40 specific environment variables to identify existing cloud credentials and secret tokens on machines.
3Anthropic System Integrity
Anthropic confirmed its internal systems and employee laptops remained uncompromised throughout the incident. Felix Rieseberg, a member of Anthropic’s technical staff, clarified that the company did not develop or publish the tampered versions. The attack specifically exploited the Cursor marketplace infrastructure rather than Anthropic’s own software development lifecycle or distribution channels.
4Cursor Marketplace Response
Cursor, acquired by SpaceX, responded by shutting down its entire extension marketplace to conduct a thorough security audit. The platform removed the malicious versions, rotated security keys, and worked with providers to take the attacker's server offline. They have since reinstated the marketplace after confirming the absence of further immediate risks.
5Mitigation and Remediation
Cursor advises all affected users to update immediately to version 2.1.314. Because the extension attempted to install persistence scripts, simple uninstallation may be insufficient. The company published specific scripts to help developers detect and remove the backdoor. Users are encouraged to review the official security blog post for detailed mitigation steps.
6Security Firm Findings
Security firm Phorion identified that the malicious version 2.1.313 effectively superseded the previous version, triggering automatic updates for many users. Researcher Luke Roberts noted that the attacker successfully utilized the official distribution channel. This incident highlights the inherent risks of automated update mechanisms in developer IDEs when marketplace security is bypassed.
7Privilege Escalation Barriers
The malware's attempt to open a reverse tunnel required administrator privileges, which it lacked on most macOS and Windows systems. Consequently, this specific phase of the attack typically failed. However, the exfiltration of environment variable names and the installation of persistence scripts still occurred, posing a significant risk to developer environments.
8Broader Industry Implications
This event underscores the growing threat of supply-chain attacks targeting developer tools. With the rise of AI-assisted coding, researchers warn that such platforms could become prime targets for malicious actors. The incident serves as a critical reminder for developers to verify extension sources and monitor automated update behaviors within their IDE environments.
Original article: The Next Web — Tampered Claude Code Extension Compromises Cursor IDE Users