Malicious Claude Code extension on Cursor planted SSH backdoors

A malicious version of Anthropic’s Claude Code extension was available in Cursor’s VS Code extension marketplace for about 11 hours on October 29, exposing up to 5,000 developers to malware that attempted to install persistent SSH backdoors.

The package, version 2.1.313, was distributed from 2:27 a.m. to 1:35 p.m. Pacific Time. Cursor said Anthropic did not develop it, but has not explained how it was published under Anthropic’s name. Researchers at Phorion and OpenSourceMalware found a malicious JavaScript loader at the start of the extension’s extension.js file; the rest of the legitimate extension code was unchanged. The malware ran when the extension loaded, without user interaction.

Phorion said coding errors likely prevented the SSH setup from working on many Windows and macOS systems where SSH was not already running. The malware could still install SSH keys, establish persistence and attempt a reverse tunnel. It also sent reconnaissance data—including usernames, hostnames, public IP addresses, Git email addresses and names of environment variables associated with sensitive credentials—to an attacker-controlled server. The script did not directly steal credentials.

Cursor removed the extension, temporarily shut down its marketplace to audit other extensions and rotate access keys, and worked with the hosting provider to take the attacker’s server offline. Cursor said its investigation found no evidence that other extension versions or the official distribution were affected. It later confirmed Cursor was the only source distributing the malicious package. BleepingComputer said it contacted Cursor and Anthropic and would update its report if it received a response.