Roughly 11 hours on October 29, a malicious version of Anthropic’s Claude Code extension was served from Cursor’s VS Code extension marketplace — potentially exposing up to 5,000 developers to malware that attempted to plant persistent SSH backdoors.
How the malicious Claude Code extension worked
The package, carrying version number 2.1.313, was available in Cursor’s marketplace between 2:27 a.m. and 1:35 p.m. Pacific Time on October 29. Researchers at Phorion and OpenSourceMalware found that attackers inserted a malicious JavaScript loader at the top of the extension’s extension.js file while leaving the legitimate extension code otherwise unchanged. The loader executes immediately when the extension loads and does not require the user to interact with Claude Code.
When installed on a host, the modified extension performed a small, focused set of actions: it collected system and user information (including the victim’s Git email and public IP address); added an attacker-controlled SSH key and attempted to enable SSH access and establish a reverse tunnel; installed persistence using a macOS LaunchAgent or a Windows scheduled task/Startup script and retried the tunnel roughly every minute; and transmitted host details and backdoor status to an attacker-controlled server at 134.209.82[.]225.
Why the backdoor largely failed to grant remote access
Phorion’s analysis identified coding errors in the malware’s SSH setup routines that likely prevented adversaries from gaining remote shells on many affected Windows and macOS systems. On macOS the script calls systemsetup -getremotelogin without elevated privileges; because the unprivileged call returns an administrator-access error rather than the SSH service status, the malware’s logic — which only tries to enable SSH when output contains “Off” — skips activation entirely.
On Windows the malware attempted to install and start the OpenSSH server through PowerShell, but did so via /bin/sh, a Unix shell not present on standard Windows installations; the mismatch caused the SSH setup to fail. In both environments the malware was still able to install SSH keys, create persistence, and attempt reverse tunnels, but unless an SSH server was already running on the target machine the tunnel could not provide interactive access.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildContainment: Cursor’s actions and the immediate aftermath
Cursor removed the malicious extension and temporarily shut down its entire marketplace to audit other extensions and rotate all access keys before restoring availability. The company also worked with the hosting provider to take the attacker’s server offline, disrupting reverse SSH connections and the transmission of reconnaissance data. After an internal investigation Cursor reported finding no evidence that any other extension versions or the official distribution had been affected.
Initial coverage indicated other distribution channels — npm, Open VSX, and Microsoft’s Visual Studio Code Marketplace — might have been impacted, but that was later clarified: Cursor was the only source that delivered the malicious package during the exposure window. BleepingComputer contacted Anthropic and Cursor with questions and said it would update the story if it received responses.
What developers, enterprises, and security teams should do now
- Developers who downloaded the package during the exposure window should check for an SSH key named svc-telemetry on their machines and follow Cursor’s remediation instructions if they find it.
- For machines confirmed impacted, Cursor recommends isolating the device, rotating accessible secrets, invalidating sessions, and rebuilding the affected environment from safe backups.
- Security teams should note that, even where the SSH backdoor failed, the extension sent reconnaissance data — username, hostname, public IP address, Git email, and names of environment variables associated with sensitive credentials — to the attacker’s server. The script did not directly exfiltrate credentials, which the researchers say is consistent with an intent to retrieve sensitive data manually after securing remote access via SSH.
- Enterprises relying on third-party extension marketplaces should review controls around extension vetting and consider monitoring for unexpected SSH keys, persistent tasks/services, and outbound connections to unfamiliar IPs in the hours after any repository disruption.
The incident closed one attack vector quickly: the malicious package was removed, and the attacker’s server taken offline. But Cursor and Anthropic have not publicly explained how a package published under Anthropic’s name reached Cursor’s marketplace in the first place, and the source record leaves that distribution question unanswered. For now, the concrete steps are practical and immediate — check for the svc-telemetry key, isolate and rebuild any affected hosts, and rotate secrets — while the unanswered supply-chain questions remain the next item on the scoreboard.
