Malicious Claude Code Extension on Cursor Marketplace Exposed Thousands of Developers to SSH Backdoor Attacks

A sophisticated supply chain attack temporarily compromised the Cursor marketplace, distributing a malicious version of Anthropic’s Claude Code VS Code extension that aimed to install persistent SSH backdoors on developers’ systems. The compromised extension, identified with version number 2.1.313, was available for approximately 11 hours on October 29, potentially impacting up to 5,000 developers. This incident highlights the growing threat of malware disguised as legitimate tools within the software development ecosystem.

The malicious extension was distributed between 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor, an AI-powered code editor built upon Microsoft’s open-source Visual Studio Code (VS Code), integrates with a vast array of VS Code extensions. Anthropic’s Claude Code extension is designed to bring its advanced AI coding assistant directly into these compatible editors, enabling developers to write and debug code more efficiently using natural language prompts. While Cursor has stated that Anthropic did not develop the malicious version, the exact method by which attackers managed to publish a compromised package under Anthropic’s name on the Cursor marketplace remains a subject of ongoing investigation.

Timeline of the Attack

The incident unfolded over a critical period, with significant actions taken by the involved parties to mitigate the damage and understand the scope of the breach.

• October 29, 2:27 a.m. PT: The malicious version of the Anthropic Claude Code extension (version 2.1.313) begins to be distributed through the Cursor VS Code extension marketplace.
• October 29, morning hours: Researchers at Phorion and OpenSourceMalware identify the malicious code embedded within the extension. They discover that attackers inserted a malicious JavaScript loader at the beginning of the extension.js file, leaving the legitimate extension code largely intact.
• October 29, 1:35 p.m. PT: Cursor identifies the compromised extension and takes action, removing it from the marketplace. The company also temporarily suspends its entire extension marketplace to conduct a thorough audit of other extensions and rotate all access keys.
• Following the discovery: Cursor collaborates with its hosting provider to take down the attacker’s server, aiming to disrupt established reverse SSH connections and halt the transmission of reconnaissance data.
• Post-incident investigation: Cursor conducts an internal investigation, reporting that it found no evidence of other extension versions or the official Anthropic distribution being affected.
• Public disclosure: Cursor issues a security notice to its users, detailing the incident and providing guidance for affected individuals.

Nature of the Malicious Payload

The core of the attack involved the insertion of a malicious JavaScript loader into the extension.js file of the Claude Code extension. This loader was designed to execute automatically when the extension loaded, without requiring any direct user interaction with the Claude Code features. Once active on a compromised system, the malware’s primary objective was to establish a persistent SSH backdoor.

The attack chain, as detailed by researchers from OpenSourceMalware, involved several stages:

1. Malicious Code Execution: The embedded JavaScript loader runs upon extension activation.
2. SSH Backdoor Attempt: The malware attempts to install and configure a persistent SSH backdoor. This typically involves adding malicious SSH keys and setting up a reverse tunnel.
3. Persistence Mechanism: The malware aims to ensure its continued presence on the system, even after reboots.
4. Data Exfiltration (Reconnaissance): Even if the SSH backdoor failed, the malware was programmed to collect and send sensitive reconnaissance data to the attacker’s server. This data included the victim’s username, hostname, public IP address, Git email address, and environment variables that might contain credentials.

Exploitation Flaws and Mitigation

A critical aspect of this incident is that coding errors within the malware’s SSH setup routines likely hindered the attackers’ ability to achieve full remote access on many affected Windows and macOS systems. These flaws prevented the malware from successfully enabling SSH on machines where it was not already running, thereby rendering the reverse tunnel ineffective for gaining control.

On macOS, the malware attempted to check the status of Remote Login using the systemsetup -getremotelogin command. However, this command was executed without the necessary elevated privileges. Consequently, instead of reporting the SSH service’s status, it generated an administrator-access error. The malware was designed to activate SSH only if the command output indicated it was "Off." Due to the error, this activation step was entirely bypassed.

For Windows systems, the malware attempted to install and start the OpenSSH server using PowerShell. However, it incorrectly tried to execute this through /bin/sh, a Unix shell that is not natively available on standard Windows installations. This fundamental misconfiguration led to the failure of the SSH setup process.

Despite these critical flaws in the SSH backdoor implementation, the malware was still capable of installing its malicious SSH keys, establishing persistence, and attempting to create the reverse tunnel. However, without an active SSH server, the tunnel could not provide the attackers with the intended remote access to the compromised device.

Even in cases where the SSH backdoor failed, the malware was still able to exfiltrate valuable reconnaissance data. This data, including system identifiers and potentially sensitive environment variables, could have been used by attackers to plan further manual intrusions or targeted attacks. The absence of direct credential theft suggests a strategy focused on gaining initial access through the SSH tunnel, followed by manual credential harvesting.

Official Responses and Remediation

Cursor acted swiftly upon identifying the malicious extension. The company’s response included several key actions:

• Removal and Marketplace Suspension: The compromised extension was immediately removed from the Cursor marketplace. To ensure a comprehensive review, the entire marketplace was temporarily taken offline. This allowed for a thorough audit of all available extensions and the rotation of all access keys, bolstering the security of the platform.
• Disruption of Attacker Infrastructure: Cursor collaborated with its hosting provider to shut down the attacker’s command-and-control server. This measure was crucial in disrupting both the established reverse SSH connections and the ongoing transmission of reconnaissance data.
• Public Notification: Cursor issued a public security notice, alerting its user base to the incident. The notice provided details about the affected extension, the timeframe of its availability, and crucial remediation steps for users who may have downloaded the compromised package.

Anthropic, the developer of the legitimate Claude Code extension, has been contacted for comment, but at the time of reporting, no detailed statement regarding their internal security measures or their assessment of the supply chain vulnerability had been released.

Broader Implications and Unanswered Questions

The incident involving the Claude Code extension on Cursor’s marketplace serves as a stark reminder of the evolving threat landscape within software development. Supply chain attacks, where malicious code is injected into legitimate software or its distribution channels, are becoming increasingly prevalent and sophisticated.

• Developer Tool Vulnerabilities: The attack targeted a tool specifically designed to aid developers, highlighting the vulnerability of development environments. Any compromise in this sector can have far-reaching consequences, potentially affecting numerous projects and end-users.
• Trust in Marketplaces: The incident raises questions about the security protocols of third-party extension marketplaces. The ability of attackers to publish malicious code under a reputable name underscores the need for more robust vetting and continuous monitoring processes.
• Supply Chain Integrity: The exact mechanism by which the attackers impersonated Anthropic and published the malicious extension remains a significant unanswered question. This could indicate a compromise of Cursor’s systems, Anthropic’s developer accounts, or a sophisticated social engineering or credential stuffing attack. The lack of clarity on this aspect leaves room for future exploitation.
• Data Exfiltration Risks: Even though the primary objective of establishing a persistent SSH backdoor may have been thwarted by coding errors, the successful exfiltration of reconnaissance data poses a significant risk. This information could be used for targeted attacks, phishing campaigns, or to identify further vulnerabilities.
• Mitigation and Recovery: For developers who downloaded the malicious extension, prompt action is crucial. Cursor has recommended checking for the presence of an ‘svc-telemetry’ SSH key on their machines. If identified, affected users are advised to isolate their machines, rotate all accessible secrets, invalidate active sessions, and ideally, rebuild their environments from trusted backups. This highlights the importance of having robust incident response plans in place.

While initial speculation suggested broader impacts on platforms like npm, Open VSX, and Microsoft’s Visual Studio Code Marketplace, it was later confirmed that Cursor was the sole distribution point for the compromised extension. This localization of the immediate threat does not diminish the severity of the attack or the lessons learned.

The incident underscores the critical need for continuous vigilance, robust security practices, and transparent communication within the software development community. As AI-powered coding assistants and integrated development environments become more commonplace, securing these tools and their distribution channels will be paramount in protecting developers and their valuable intellectual property. The investigation into how this attack was executed continues, with the hope that further clarity will emerge, strengthening defenses against future supply chain threats.