Cursor Marketplace Distributed Backdoored Claude Code Extension with SSH Persistence
Cursor disclosed that its extensions marketplace distributed tampered versions (2.1.312 and 2.1.313) of the Claude Code extension between approximately 2:27 am and 1:35 pm PDT on October 29, 2026. The malicious packages retained the legitimate anthropic.claude-code identity and genuine bundled binary but included a 66-line malicious loader inserted before the extension's normal JavaScript code, as identified by OpenSourceMalware in its analysis of version 2.1.313. The loader collected host and user information and attempted to add an attacker-controlled SSH key, enable SSH, and create a reverse tunnel for remote access. Microsoft confirmed the packages were not distributed via its Visual Studio Marketplace or the npm Claude Code package, and Anthropic stated its own systems were not compromised. Cursor temporarily closed the marketplace, rotated keys, rebuilt the platform, and worked with a hosting provider to take the attacker's server offline.
Detalhes técnicos
The altered extension.js file executed the malicious loader when the extension activated after startup or when its webview opened. Cursor said coding errors and administrator-permission requirements blocked successful SSH access on most Windows and macOS machines, but the package could still leave behind an unauthorized SSH key, startup persistence files, and transmitted device information even when the tunnel failed. Microsoft identified additional persistence mechanisms outside the extension's installation directory, including a macOS LaunchAgent, a Windows scheduled task named SysMon, and a fallback script in the Windows Startup folder.
Remediação
Affected users should follow Cursor's official detection and remediation instructions, remove any unauthorized SSH key and persistence files, and rotate accessible credentials from a trusted computer. Cursor provides separate cleanup scripts for Windows and macOS and advises assessing whether affected machines need to be rebuilt. Cursor's initial notice cited up to 5,000 affected users; that figure was later removed from the updated notice, which instead identifies both affected versions.
Linha do tempo
-
Cursor Marketplace Distributed Backdoored Claude Code Extension with SSH Persistence
ler a análise desta fonte ocultar
Cursor disclosed that its extensions marketplace distributed tampered versions (2.1.312 and 2.1.313) of the Claude Code extension between approximately 2:27 am and 1:35 pm PDT on October 29, 2026. The malicious packages retained the legitimate
anthropic.claude-codeidentity and genuine bundled binary but included a 66-line malicious loader inserted before the extension's normal JavaScript code, as identified by OpenSourceMalware in its analysis of version 2.1.313. The loader collected host and user information and attempted to add an attacker-controlled SSH key, enable SSH, and create a reverse tunnel for remote access. Microsoft confirmed the packages were not distributed via its Visual Studio Marketplace or the npm Claude Code package, and Anthropic stated its own systems were not compromised. Cursor temporarily closed the marketplace, rotated keys, rebuilt the platform, and worked with a hosting provider to take the attacker's server offline.Technical Details
The altered
extension.jsfile executed the malicious loader when the extension activated after startup or when its webview opened. Cursor said coding errors and administrator-permission requirements blocked successful SSH access on most Windows and macOS machines, but the package could still leave behind an unauthorized SSH key, startup persistence files, and transmitted device information even when the tunnel failed. Microsoft identified additional persistence mechanisms outside the extension's installation directory, including a macOS LaunchAgent, a Windows scheduled task named SysMon, and a fallback script in the Windows Startup folder.Remediation
Affected users should follow Cursor's official detection and remediation instructions, remove any unauthorized SSH key and persistence files, and rotate accessible credentials from a trusted computer. Cursor provides separate cleanup scripts for Windows and macOS and advises assessing whether affected machines need to be rebuilt. Cursor's initial notice cited up to 5,000 affected users; that figure was later removed from the updated notice, which instead identifies both affected versions.