A trojanized Claude Code extension was served from Cursor's extension marketplace

Cursor says it identified a security incident involving a modified Claude Code VS Code extension distributed through its extension marketplace, affecting at most 5,000 users. Cursor says the malicious version was not developed by Anthropic and that no other extension is affected.

What Cursor's advisory says (as relayed by a security researcher):

• The affected build is Anthropic.claude-code v2.1.313, served on October 29 from 09:27 to 20:35 UTC, for macOS ARM64 and Windows x64.
• Loading the extension runs malicious code that collects host information and tries to install a persistent SSH backdoor. Cursor says SSH access would fail on most hosts because of bugs and insufficient privileges, which limits remote access but does not undo the code execution.
• Credentials and repositories reachable from the affected account are potentially at risk. Cursor says the package has been removed and the command-and-control server taken offline.
• Uninstalling the extension may leave persistence behind. The researcher advises anyone who ran this version to investigate the host, remove persistence and rotate accessible credentials from a clean machine; updating the extension alone does not show the machine is clean.

Independent analysis: OpenSourceMalware, and separately Phorion, published write-ups with indicators of compromise. OpenSourceMalware, as summarized in a post about it, says the loader adds an attacker SSH key to authorized_keys, enables sshd, opens a reverse SSH tunnel, sets up persistence (a LaunchAgent, cron job or scheduled task) and sends host information and the names of secret environment variables to an attacker-controlled server. These are the researchers' findings, not Anthropic's.

Anthropic's Felix Rieseberg, who works on Claude Code, says Anthropic is working with Cursor on the incident but that it was not a compromise of Anthropic's systems or employee laptops: in his account, a malicious actor used access to Cursor's marketplace to publish a tampered copy of the extension, which Anthropic did not build or publish. He says the versions on Anthropic's official channels are not affected and that only Cursor users are impacted.

The researcher's reading of the reports is that they do not establish a compromise of Microsoft's VS Code marketplace or a malicious npm release. Cursor's advisory has cleanup instructions.