Up to 5,000 Users Downloaded Backdoored Extension From Cursor Marketplace
In a concerning cybersecurity incident, it has come to light that a backdoored version of the official Claude Code Visual Studio Code (VS Code) extension was made available for download on the Cursor Marketplace, affecting up to 5,000 users. The malicious extension, which went undetected for an alarming 11 hours, was identified to compromise security by granting attackers persistent SSH access to any endpoint where the extension was installed.
Cursor, a software platform based in San Francisco and owned by the SpaceX subsidiary SpaceXAI, disclosed in a security alert that the compromised version of the Claude Code extension was numbered 2.1.313. The extension was live on the Cursor Marketplace from approximately 9:27 a.m. to 8:35 p.m. UTC on a Thursday, during which time users unknowingly downloaded the malicious software.
The company is noted for developing Cursor, an artificial intelligence coding agent and integrated development environment (IDE), and the marketplace is designed to host various extensions for the Cursor software. Following the detection of the malicious extension, Cursor made an official statement emphasizing that this version was not developed by Anthropic, the company behind the legitimate Claude Code extension.
Cursor’s announcement revealed that their security investigation confirmed the backdoor incident impacted a maximum of 5,000 users. They swiftly acted to take down their extension marketplace, coordinate with relevant parties to neutralize the malware, and later reinstated the marketplace after ensuring there was no further risk to users.
In its attempt to assist those affected, Cursor plans to directly contact all users who downloaded version 2.1.313 and has provided detailed instructions on how to search for potential signs of compromise. Researchers have recommended that any system with the compromised extension should be isolated immediately and subjected to a thorough digital forensic investigation to assess the extent of the damage.
In a parallel statement, Anthropic confirmed the attack, clarifying that a malicious actor exploited access to Cursor’s marketplace to upload the tampered extension, asserting that they were not involved in its development, publication, or hosting. This incident highlights the vulnerability of software supply chains and the potential dangers posed by such attacks.
The technical aspect of the attack reveals that the implant discreetly added to the Claude Code extension was designed to establish a reverse SSH tunnel, also known as remote port forwarding. This mechanism allows a remote attacker to connect to the infected system, potentially circumventing firewalls or network address translations that might ordinarily block such access. Phorion, a company specializing in macOS endpoint detection, was among the first to raise the alarm about the compromised extension, stipulating that its malicious features were capable of executing code on Windows, Linux, or macOS systems, thus gaining access to various types of data.
Phorion articulated that because extensions operate with the permissions of the IDE and the user, a compromised extension can gain immediate access to local files, source code, and developer tools once the module is loaded. Cursor also underscored that the malicious code aimed to append an attacker-controlled SSH key to the authorized_keys file, enable the local SSH service, and open a reverse SSH tunnel. Remarkably, due to flaws in the malicious code, this step would have failed under normal circumstances, particularly if Cursor was not started with administrator privileges.
Security researcher Paul McCarty shared insights indicating that the backdoored version of the extension was nearly identical to the legitimate one, with the sole exception being a malicious script in the extension.js file. This script included a 66-line loader that precedes the legitimate code, signifying that users did not need to interact with Claude for the attack to progress.
McCarty disclosed that the loader functions by adding an attacker-controlled key to the user’s SSH configuration and attempts to activate the local SSH service, thereby establishing a reverse tunnel while transmitting reconnaissance data—including hostname, local username, and other sensitive details—over an unencrypted HTTP beacon.
While it remains unclear if the implant transferred this sensitive information to a command-and-control server, the risk of such data being accessed directly by an attacker with SSH access is substantial. Cursor confirmed that the attack server has been rendered unreachable following collaboration with the cloud provider hosting it, effectively shutting down the operational capabilities of the malware.
Although the attack itself aimed to engage the local SSH service, it requires admin-level rights that would typically not be granted to the extension on most systems, meaning that while the reverse SSH tunnel might not have been established, the addition of the attacker’s SSH key still posed a significant security risk, necessitating prompt remediation efforts from affected users.
Subsequent to the incident, Cursor conducted a thorough review of all other extensions in the marketplace, finding no indicators of tampering, allowing them to restore marketplace operations. Anthropic released a new version, 2.1.314, devoid of the malicious code, but experts caution that the previous backdoors and reconnaissance capabilities might still persist unless manual remediation occurs.
This incident serves as a stark reminder of the vulnerabilities inherent in software distributions and emphasizes the importance of stringent security measures within the software development lifecycle to protect users from such threats. The ramifications of this attack could lead to increased scrutiny of software supply chains and further discussions regarding the balance of functionality and security in extension markets.