Backdoored Claude Code Extension Circulated on Cursor's Marketplace for 11 Hours
Seven Lights
Cursor confirmed that malicious versions of Anthropic’s Claude Code extension were available through its VS Code extension marketplace for roughly eleven hours on October 29, exposing as many as 5,000 developers to software designed to install a persistent SSH backdoor on their machines.
The affected packages, published under the identifier Anthropic.claude-code at versions 2.1.312 and 2.1.313, were live between about 2:27 a.m. and 1:35 p.m. Pacific time, Cursor said in a security notice. The tampered extension targeted Windows and macOS systems.
Researchers at the security firms Phorion and OpenSourceMalware found that the attackers inserted a malicious JavaScript loader at the beginning of the extension’s extension.js file, leaving the legitimate code otherwise unchanged. Once run, the payload attempted to plant an SSH backdoor for lasting remote access, reporting to a hidden endpoint on port 8099 and adding an entry named svc-telemetry to the system’s authorized keys.
Cursor advised teams to inspect authorized keys for that entry, review extension installation records, endpoint alerts and network logs, and isolate hosts where evidence shows the payload executed. Removing the extension alone is not sufficient, the company warned, because separate scripts can remain; it published platform-specific cleanup guidance and urged rotation of credentials and sessions from a trusted system.
Anthropic has said the compromised packages were not published by it. The Register reported the company distanced itself from the compromise, and the extension’s official versions remained unaltered.
The episode struck at a central assumption of modern software work: that extension marketplaces operated by major tools vendors are a controlled channel. Cursor, an artificial-intelligence code editor built from Microsoft’s open-source Visual Studio Code, said the incident was contained to the eleven-hour window and that it had removed the packages. Security firms urged organizations that use the editor to audit developer machines from the Oct. 29 window regardless of whether tampered versions appeared to install.