Cursor users have been targeted with malicious versions of Anthropic’s Claude Code extension in a new supply chain attack.
The incident occurred on October 29 and involved versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension, which were live in the Cursor VS Code Extension Marketplace for roughly 11 hours.
Aiming at both macOS and Windows users, the extension contained JavaScript code designed to run when modules were loaded to establish a reverse SSH tunnel.
Roughly 5,000 developer systems might have downloaded the malicious versions, security researcher Kevin Beaumont notes.
The modified extension versions were not developed by Anthropic, and neither was pushed to the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry.
“A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected, and this only impacts Cursor users,” Anthropic’s Felix Rieseberg said.
To avoid confusion, Anthropic updated its legitimate Claude Code extension directly to version 2.1.314.
Cursor removed the modified Claude Code extension from the store immediately after identifying it and suspended the marketplace to investigate the incident. Cursor found no other malicious extensions, rotated all keys, and rebuilt and reopened the marketplace.
Additionally, it worked with the cloud provider hosting the attacker’s server to take it offline.
“We have no evidence that other versions of the extension or the official distribution are affected,” Cursor said.
The modified extension versions contained a JavaScript function that was executed during module loading to collect host information, modify files, and run OS commands.
“The loader first collects host reconnaissance. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A delayed callback subsequently attempts to send host details,” Microsoft notes.
The code was observed collecting information such as hostname, username, OS, system architecture, working directory, and global Git email, as well as deploying platform-specific scripts and startup configurations for persistence.
According to Cursor, because enabling the local SSH service requires admin rights and the extension does not have them on most macOS and Windows systems, the step failed, preventing the attackers from logging in through the tunnel.
Users should remove the malicious extension versions as soon as possible. Cursor has released a script to help users detect infections, along with indicators of compromise (IoCs) to identify potential compromises across environments.
“Isolate hosts showing evidence of payload execution or backdoor installation. Remove the unauthorized SSH key, persistence mechanisms, and running tunnel processes, and assess whether the host should be rebuilt. Uninstalling the extension may not be sufficient — the payload drops standalone persistence scripts that keep running,” Cursor notes.
Related: LiteLLM Compromised in Fresh Supply Chain Attack
Related: Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
Related: AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
Related: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
