/
Tampered Claude Code extension on Cursor's marketplace carried SSH backdoor; up to 5,000 users may be affected
A trojanized Claude Code extension, version 2.1.313, was served on Cursor's marketplace on 29 October for about 11 hours, with a loader that adds an SSH key and persistence. Cursor says at most 5,000 users were affected and Anthropic did not write it; a clean 2.1.314 is out.
P
3 min
A tampered version of Anthropic's Claude Code extension was distributed through the Cursor Marketplace on 29 October as a legitimate update under Anthropic's publisher identity. Cursor says that at most 5,000 users were affected, and that the malicious version was not developed by Anthropic. The version, 2.1.313, carried a loader that adds an attacker's SSH key to a machine and sets up persistence. Cursor temporarily shut down its marketplace to remove the package, and Anthropic has published a clean version, 2.1.314.
What happened
The trojanized extension, identified as anthropic.claude-code, was served as an update through the Cursor Marketplace. How the attackers introduced it is unclear. Cursor did not say whether its own systems were breached, and Anthropic has said that its systems were not breached, according to one report. Security researchers found a 66-line malicious loader inserted before the legitimate code in the extension's main JavaScript bundle.
There is no evidence that the update reached the Open VSX registry or Microsoft's VS Code Marketplace. One early report said that the extension was on Open VSX, and that was later corrected.
The timeline
The malicious versions were installed between about 2:27 am and 1:35 pm Pacific time on 29 October, which is just under 11 hours. Other reports put it at nearly 12 hours. By 30 October the malicious version had been removed, and Anthropic had published version 2.1.314 to Open VSX and the Microsoft VS Code Marketplace.
The loader activates after VS Code starts and when the extension's webview opens. According to the technical report:
- It adds an attacker-controlled SSH key, labelled svc-telemetry, to the file authorized_keys in the user's .ssh folder.
- It tries to enable SSH on Windows, Linux and macOS.
- It opens a reverse tunnel to an address, 134.209.82.225.
- It installs persistence through a scheduled task, a crontab entry or a LaunchAgent.
- It sends host reconnaissance over unencrypted HTTP to the same address on port 8099. The data includes the public IP address, hostname, local username, operating system and CPU architecture, home and current directories, the global Git email and the names, but not the values, of up to 40 environment variables whose names contain KEY, TOKEN, SECRET, PASS, AWS or GCP.
No other follow-on payloads have been observed. Cursor says that enabling SSH needs administrator rights, which the extension usually lacks on macOS and Windows, so the tunnel probably could not be used there. It still says that the key, the persistence and the data exfiltration occur, and it advises following the remediation steps regardless.
Cursor says at most 5,000 users were affected and that it will contact them directly. It also says that the malicious version did not affect other extensions or products on its marketplace. No third party has verified the number, and it is a ceiling and not a confirmed count.
The report advises the following steps for anyone who installed version 2.1.313:
- Isolate the affected machine.
- Remove the unauthorised SSH key and the persistence mechanisms.
- Rotate credentials and sessions.
- Update the extension to 2.1.314 or later.
To check, look for the svc-telemetry entry in the authorized_keys file, for an unexpected scheduled task, crontab entry or LaunchAgent, and for connections to 134.209.82.225, especially on port 8099, and check whether the installed version of the extension is 2.1.313.
The reports found do not give a direct statement from Anthropic beyond the release of the clean version, and they do not say who is behind the attack. They do not say how many of the possible 5,000 users actually ran the malicious code, or whether any data was in fact stolen.
P
3 min
What did you think?
