News

Malicious Claude Code extension update exposed Cursor users to SSH backdoor

A compromised version of Anthropic's Claude Code extension was distributed through the Cursor Marketplace, potentially exposing thousands of developers to a persistent SSH backdoor.

The malicious update was published under the legitimate Claude Code extension identity, making it appear to users as an official update. According to Cursor, the incident may have affected up to 5,000 users who installed or automatically received the compromised versions from the Cursor Marketplace on October 29.

The modified extension attempted to add an attacker-controlled SSH key to affected systems, create persistence mechanisms and establish a reverse SSH connection to an external server. It also collected basic system information, including usernames, operating system details, Git email addresses and the names of environment variables that could indicate the presence of credentials or cloud access tokens.

The attack was limited to the Cursor Marketplace. Anthropic confirmed that its own systems were not compromised, while Microsoft and Open VSX confirmed that the malicious versions were not distributed through their marketplaces. Cursor has since removed the affected packages, rebuilt its marketplace infrastructure and rotated relevant security keys.

Users who installed Claude Code versions 2.1.312 or 2.1.313 through the Cursor Marketplace are advised to inspect their systems carefully. Simply updating or removing the extension may not be enough, as the malware could have created SSH keys, startup entries and other persistent files outside the extension itself. Credentials and active sessions on affected systems should also be rotated.

The incident highlights the growing importance of securing software marketplaces and development-tool supply chains, where a trusted update mechanism can become an effective route for distributing malware.