Tampered Claude Code extension slipped through Cursor’s marketplace and backdoored thousands of developer machines

On October 29, a malicious version of Anthropic’s Claude Code VS Code extension was quietly distributed through Cursor’s extension marketplace, exposing as many as 5,000 developers to SSH backdoors and credential theft before Cursor removed it roughly 11 hours later.

The trojanized package, version 2.1.313, was available from 2:27 a.m. to 1:35 p.m. PT. Security researchers who analyzed it found a malicious JavaScript loader injected at the top of extension.js — everything else in the package matched the legitimate extension. The loader ran automatically when a developer opened the extension, requiring no additional interaction.

Once active, the malware collected system information including usernames, hostnames, public IP addresses, Git emails, and the names of credential-related environment variables, then transmitted that data to an attacker-controlled server at 134.209.82.225. It simultaneously attempted to add an attacker SSH key, enable SSH access, and establish a persistent reverse tunnel via a macOS LaunchAgent or a Windows scheduled task, retrying the connection every minute.

The backdoor’s actual reach was limited by coding errors. On macOS, the SSH-enable step failed unless the command output contained the string “Off,” a condition that was rarely met. On Windows, the OpenSSH setup was routed through /bin/sh, which isn’t installed on standard Windows machines. Even so, the reconnaissance data — names of environment variables that might hold API keys, cloud credentials, or tokens — suggests the attackers were identifying machines for manual follow-up, not automated harvesting.

Cursor pulled the extension from its marketplace, temporarily shut down the entire extension store to audit other packages, and rotated access keys. The company also worked with the hosting provider to take the attacker’s command-and-control server offline. Cursor found no evidence the attack spread to the official VS Code Marketplace, npm, or Open VSX. BleepingComputer reported that both Cursor and Anthropic had been contacted but had not responded at publication time.

The supply-chain angle is the story’s most troubling element: it remains publicly unexplained how the attackers managed to publish a malicious package under Anthropic’s verified name. Developer extension marketplaces have become an increasingly attractive vector for supply-chain attacks precisely because developers tend to trust packages from known vendors, and IDEs typically load extensions with broad system permissions.

Developers who installed version 2.1.313 between those hours should check their machines for an SSH key named svc-telemetry. If found, security teams recommend isolating the machine, rotating all accessible secrets and sessions, and rebuilding from a known-clean backup.

As first reported by BleepingComputer.