Tampered Claude Code extension published to Cursor marketplace in supply chain attack, opening reverse SSH tunnel
On October 29, a malicious actor used access to Cursor's extension marketplace to publish tampered versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension. The versions were live for roughly 11 hours and targeted macOS and Windows users. Researcher Kevin Beaumont estimates about 5,000 developer systems may have downloaded them. Anthropic says it did not build or publish the versions and that its official channels (Microsoft Visual Studio Marketplace, Open VSX, NPM) were not affected.
Detalhes técnicos
- The extension contained JavaScript that ran on module load to collect host reconnaissance (hostname, username, OS, architecture, working directory, global Git email).
- It attempted to install an SSH key, enable SSH, create a reverse SSH tunnel and configure persistence, then sent host details via a delayed callback (Microsoft).
- It dropped platform-specific scripts and startup configurations for persistence.
- Cursor says enabling the local SSH service requires admin rights, which the extension usually lacks on macOS and Windows, so the step failed and attackers could not log in through the tunnel.
Remediação
- Remove the malicious extension versions; Anthropic released clean version 2.1.314.
- Cursor removed the extension, suspended the marketplace, rotated all keys, rebuilt and reopened the marketplace, and had the attacker's server taken offline with the hosting provider. It found no other malicious extensions.
- Use the Cursor detection script and published IoCs.
- Isolate hosts showing payload execution or backdoor installation, remove the unauthorized SSH key, persistence mechanisms and tunnel processes, and consider rebuilding the host. Uninstalling the extension alone may not suffice because standalone persistence scripts keep running.
Linha do tempo
-
Tampered Claude Code extension published to Cursor marketplace in supply chain attack, opening reverse SSH tunnel
ler a análise desta fonte ocultar
On October 29, a malicious actor used access to Cursor's extension marketplace to publish tampered versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension. The versions were live for roughly 11 hours and targeted macOS and Windows users. Researcher Kevin Beaumont estimates about 5,000 developer systems may have downloaded them. Anthropic says it did not build or publish the versions and that its official channels (Microsoft Visual Studio Marketplace, Open VSX, NPM) were not affected.
Technical Details
- The extension contained JavaScript that ran on module load to collect host reconnaissance (hostname, username, OS, architecture, working directory, global Git email).
- It attempted to install an SSH key, enable SSH, create a reverse SSH tunnel and configure persistence, then sent host details via a delayed callback (Microsoft).
- It dropped platform-specific scripts and startup configurations for persistence.
- Cursor says enabling the local SSH service requires admin rights, which the extension usually lacks on macOS and Windows, so the step failed and attackers could not log in through the tunnel.
Remediation
- Remove the malicious extension versions; Anthropic released clean version 2.1.314.
- Cursor removed the extension, suspended the marketplace, rotated all keys, rebuilt and reopened the marketplace, and had the attacker's server taken offline with the hosting provider. It found no other malicious extensions.
- Use the Cursor detection script and published IoCs.
- Isolate hosts showing payload execution or backdoor installation, remove the unauthorized SSH key, persistence mechanisms and tunnel processes, and consider rebuilding the host. Uninstalling the extension alone may not suffice because standalone persistence scripts keep running.