Malicious Claude Code Extension Attempted SSH Backdoor Installation in Cursor Marketplace

A malicious version of Anthropic’s Claude Code extension, distributed through the Cursor VS Code Extension Marketplace, attempted to install a persistent Secure Shell (SSH) backdoor on developers’ machines. The compromised extension targeted both Windows and macOS users, potentially granting attackers remote access to systems containing sensitive source code and credentials.

Cursor, the AI-powered code editor, confirmed in a security notice that the compromised versions—identified as 2.1.312 and 2.1.313—were available in its marketplace for approximately 11 hours on 29 October. The company has since removed the malicious versions and temporarily shut down its marketplace to audit access, rotate keys, and rebuild the service.

Malware Execution and Persistence

Security researchers at Phorion discovered that the malicious code was inserted at the beginning of the extension’s JavaScript file. This allowed the payload to execute immediately upon the extension loading, requiring no interaction from the user to trigger the attack.

The malware attempted to add an attacker-controlled SSH key to the user’s authorized_keys file, enable local SSH access, and establish a reverse tunnel to a remote server controlled by the attacker. It also created scripts and startup entries designed to ensure the connection remained available even after a system restart.

While the malware’s attempt to enable SSH on macOS was partially hindered by the requirement for administrator privileges, the core threat remained. Even without administrative rights, the extension could still plant the attacker’s SSH key and install persistence mechanisms on the host machine.

Data Collection and Exfiltration

In a separate analysis, Microsoft Threat Intelligence detailed the scope of information the malware attempted to collect. The malicious code gathered machine names, usernames, operating systems, working directories, and Git email addresses.

The malware also actively searched for environment variable names containing sensitive terms such as “KEY”, “TOKEN”, “SECRET”, “PASS”, “AWS”, or “GCP”. Microsoft noted that while the code identified up to forty matching variable names, it collected the names themselves rather than the actual values stored within them.

The Risk of Incomplete Removal

Security experts have warned that simply uninstalling the malicious extension may not be sufficient to secure an affected workstation. Because the malware placed scripts outside of the extension’s specific installation directory, components of the attack could remain on the system.

Steve Povolny, vice president of AI strategy and security research at Exabeam, noted the severity of the planted SSH key. “Removing the extension only sends the visitor away while the spare key stays on the hook,” Povolny said, highlighting that the attacker’s access could persist via the modified authorized_keys file.

Anthropic clarified that the incident did not involve a compromise of Anthropic’s own systems or employee devices. Instead, a malicious actor gained access to Cursor’s marketplace to publish the tampered extension.

Recommended Mitigation Steps

Developers who may have installed the compromised versions are advised to take the following steps to secure their environments:

• Manually inspect and audit authorized_keys files for any unfamiliar SSH key fingerprints.
• Rotate all potentially exposed credentials, including API keys, tokens, and cloud provider secrets.
• Review system and authentication logs for any unauthorised logins using suspicious keys.
• Implement stricter controls over extension marketplaces, such as allowlisting and package integrity checks.