A malicious version of Anthropic’s Claude Code extension for Visual Studio Code was available through Cursor’s extension marketplace for approximately 11 hours on October 29, potentially exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. The compromised extension, version 2.1.313, was distributed between 2:27 a.m. and 1:35 p.m. Pacific Time before Cursor removed it and temporarily shut down its marketplace.
Malicious Claude Code extension distributed through Cursor
Cursor is an AI-powered code editor based on Microsoft’s open-source Visual Studio Code (VS Code) and supports VS Code extensions. Anthropic’s Claude Code extension provides an AI coding assistant inside compatible editors, allowing developers to write and debug software using natural-language instructions.
Cursor said Anthropic does not develop any malicious extensions, but the company has not explained how attackers distributed the compromised package under Anthropic’s name.
“Between approximately 2:27 AM PT and 1:35 PM PT today, a maliciously modified version of Anthropic’s Claude Code extension became available in the Cursor VS Code extension marketplace,” Cursor said in a security notice.
“This extension executes malicious code that attempts to install a persistent SSH backdoor.”
Researchers at Phorion and Open Source Malware found that the attacker injected a malicious JavaScript loader at the beginning of the extension’s extension.js file. The remainder of the extension’s code was left unchanged.
The injected code runs when the extension loads and does not require any interaction from the user.
How the malware attempted to maintain access
Once installed, the malicious extension performed several actions on affected systems:
- Collected system and user information, including the victim’s Git email address and public IP address.
- Attempted to add an attacker-controlled SSH key and enable SSH access to create a reverse tunnel.
- Established persistence through a macOS LaunchAgent or a Windows scheduled task or startup script, retrying the tunnel approximately every minute.
- Sent host information and backdoor status to the attacker’s server at IP address
134.209.82.[.]225.
Source: Open Source Malware
However, Phorion said a coding error in the malware’s SSH setup routine may have prevented the attackers from gaining remote access to many affected Windows and macOS systems.
The error prevented the malware from enabling SSH on machines where the service was not already running, meaning the reverse tunnel could not provide access to those devices.
SSH setup failed on macOS and Windows
On macOS, the malware checked whether remote login was enabled with the systemsetup -getremotelogin command. Because it ran the command without elevated privileges, the system returned an administrator-access error instead of the SSH service status.
The malware only attempted to enable SSH when the command output contained “off,” so it skipped the activation step after receiving the error.
On Windows, the malware attempted to install and start the OpenSSH server through PowerShell. However, it tried to run the command through /bin/sh, a Unix shell that is not available in standard Windows installations. As a result, the SSH setup failed.
In both cases, the malware could install SSH keys, establish persistence, and attempt to create a reverse tunnel. If the SSH server was not already running, however, the tunnel could not provide access to the compromised machine.
Reconnaissance data was still collected
Even when the SSH backdoor failed, the malware sent reconnaissance data to the attacker’s server. This information included the victim’s username, hostname, public IP address, Git email address, and the names of environment variables associated with sensitive credentials.
The script did not directly steal credentials, suggesting that the attacker may have intended to retrieve sensitive data manually after gaining access through an SSH tunnel.
Cursor removes the extension and investigates
Cursor removed the malicious extension, temporarily took down its entire marketplace, audited other extensions, and rotated all access keys before restoring access.
The company also worked with hosting providers to take the attacker’s servers offline, disrupting both reverse SSH connections and the transmission of reconnaissance data.
Cursor said its internal investigation found no evidence that other enhanced versions or official distributions were affected.
Anyone who downloaded version 2.1.313 during the exposure period should check whether the svc-telemetry SSH key is present on their machine and follow Cursor’s remediation steps if they are confirmed to be affected.
For affected systems, users should isolate the machines, rotate accessible secrets, disable sessions, and rebuild the environment from secure backups.
Initial reports suggested that npm, Open VSX, and Microsoft’s Visual Studio Code Marketplace might also have been affected. It was later confirmed that Cursor was the only source distributing the malicious extension.
Supply chain attack details remain unclear
Several questions remain unanswered, including how the threat actor published the malicious extension under Anthropic’s name in Cursor’s marketplace and whether Cursor’s or Anthropic’s systems were compromised during the incident.
BleepingComputer contacted Anthropic and Cursor with questions about the attack and will update the report if the companies respond.
Source: www.bleepingcomputer.com