Malicious Claude Code Extension in Cursor Marketplace Attempted to Set Up Reverse SSH Tunnel
Summary
Malicious Claude Code extension versions 2.1.312 and 2.1.313 were available in Cursor’s marketplace for about 11 hours on Oct. 29. The code attempted reconnaissance and persistence; Cursor removed the versions and issued detection and response guidance.
Key points
- Versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension were available in Cursor’s marketplace for about 11 hours on October 29; Anthropic said it did not develop or publish them.
- The extension targeted macOS and Windows and contained JavaScript that collected host information, modified files, and ran operating-system commands.
- The payload attempted to install an SSH key, enable SSH, establish a reverse tunnel, and configure persistence.
- Cursor said the SSH step failed on most macOS and Windows systems because enabling the local SSH service requires administrator rights. It reported no evidence that other versions or official distributions were affected.
- Researcher Kevin Beaumont estimated that roughly 5,000 developer systems might have downloaded the malicious versions; the article does not confirm how many systems were compromised.
- Cursor removed the extensions, rotated keys, investigated and reopened its marketplace, and worked with the hosting provider to take the attacker’s server offline.
- Users were advised to remove the affected versions, use Cursor’s detection script and IoCs, and investigate hosts for unauthorized SSH keys, persistence, and running tunnels; uninstalling the extension alone may not remove dropped persistence scripts.
Article Details
- Event Type
- Supply-chain attack involving tampered versions of Anthropic’s Claude Code extension distributed through the Cursor VS Code Extension Marketplace.
- Impact
- Versions 2.1.312 and 2.1.313 were available for roughly 11 hours and targeted macOS and Windows users. The extension could collect host information, modify files, run OS commands, and attempt to establish a reverse SSH tunnel and persistence. Roughly 5,000 developer systems might have downloaded the versions, according to security researcher Kevin Beaumont. Cursor said the SSH step failed on most macOS and Windows systems because it required admin rights, and it reported no other malicious extensions. Cursor removed the extension, took the marketplace offline while investigating, rotated keys, rebuilt and reopened the marketplace, and worked with the cloud provider to take the attacker’s server offline.
MITRE ATT&CK
T1033 · System Owner/User DiscoveryThe extension collected the username and global Git email as host information.T1059 · Command and Scripting InterpreterThe extension could run OS commands and deploy platform-specific scripts.T1082 · System Information DiscoveryThe extension collected host details including operating system and system architecture.T1547 · Boot or Logon Autostart ExecutionThe extension attempted to configure persistence using startup configurations and standalone persistence scripts.T1572 · Protocol TunnelingThe loader attempted to establish a reverse SSH tunnel.
People
Vendors
Products
Claude CodeCursor users have been targeted with malicious versions of Anthropic’s Claude Code extension in a new supply chain attack.CursorCursor users have been targeted with malicious versions of Anthropic’s Claude Code extension in a new supply chain attack.macOSAiming at both macOS and Windows users, the extension contained JavaScript code designed to run when modules were loaded to establish a reverse SSH tunnel.Microsoft WindowsAiming at both macOS and Windows users, the extension contained JavaScript code designed to run when modules were loaded to establish a reverse SSH tunnel.