Malicious Claude Code Extension on Cursor Attempted to Install SSH Backdoors
Summary
A malicious Claude Code extension was available on Cursor’s marketplace for about 11 hours, exposing up to 5,000 developers to malware that attempted to install persistent SSH access and collect system data. Cursor removed it and took the attacker’s server offline.
Key points
- Version 2.1.313 was distributed through Cursor’s extension marketplace from 2:27 a.m. to 1:35 p.m. Pacific Time on October 29, potentially exposing up to 5,000 developers.
- A JavaScript loader ran when the extension loaded, collected system and user information, added an attacker-controlled SSH key, and attempted to establish a reverse tunnel.
- The malware attempted persistence through a macOS LaunchAgent or Windows scheduled task or Startup script. Researchers said coding errors likely prevented SSH access on many affected systems.
- Even if the backdoor could not connect, the malware could send reconnaissance data, including usernames, hostnames, public IP addresses, Git email addresses, and names of environment variables associated with sensitive credentials. The article says the script did not directly steal credentials.
- Cursor removed the extension, temporarily shut down its marketplace for an audit and access-key rotation, and worked with the hosting provider to take the attacker’s server offline.
- Cursor said its investigation found no evidence that other extension versions or the official distribution were affected; Cursor was later identified as the only source distributing the malicious extension.
- Users who downloaded the package during the exposure window were advised to check for an 'svc-telemetry' SSH key and, if affected, isolate systems, rotate accessible secrets, invalidate sessions, and rebuild from safe backups.
Article Details
- Event Type
- Supply-chain attack involving a malicious extension distributed through Cursor's extension marketplace
- Impact
- The malicious Claude Code extension version 2.1.313 was available for approximately 11 hours and may have exposed up to 5,000 developers. It attempted to install persistent SSH backdoors and sent host reconnaissance data to an attacker-controlled server. According to Phorion, errors in the SSH setup likely prevented remote access on many affected Windows and macOS systems.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 134[.]209[.]82[.]225 | Attacker's server used to receive host details and backdoor status; the article says the hosting provider took it offline. |
MITRE ATT&CK
T1053.005 · Scheduled TaskOn Windows, the extension attempted to establish persistence through a scheduled task.T1098.004 · SSH Authorized KeysThe extension attempted to add an attacker-controlled SSH key for persistent access.T1543.001 · Launch AgentOn macOS, the extension attempted to establish persistence through a LaunchAgent.