Backdoored copies of the Claude Code extension appear on Cursor's extension marketplace for about 11 hours
Cursor's notice has the timeline, checks and cleanup scripts; Phorion's analysis explains how the backdoor works and why a bug kept it from fully succeeding on Macs.
Cursor says that on October 29, between about 2:27 a.m. and 1:35 p.m. Pacific, its VS Code extension marketplace served maliciously modified versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension for Windows and macOS, versions not made by Anthropic. The code ran as soon as the extension loaded: it sent host and user details to the attacker, added an attacker SSH key labeled "svc-telemetry" to the user's authorized keys, tried to enable SSH and open a reverse tunnel, and set up persistence. Cursor says errors in the malware meant the SSH step failed unless Cursor ran with admin rights. It pulled the versions, shut down and rebuilt the marketplace, rotated keys and had the attacker's server taken offline. Affected users should run its check, remove the key and persistence, and rotate credentials; uninstalling alone may not be enough.
The security firm Phorion, which also detected it, published a technical analysis, including the macOS permission-check mistake that skips turning on Remote Login.
-
Supply chain attack
After exploring Official Claude Code Extension Compromise: Security Advisory | Phorion, for the wider pattern, read about Supply chain attack.
Explains attacks that target less secure links in a supply chain, such as tampering with software distribution to plant malware.
Wikipedia · Wade · 5 min
0 -
Open VSX
After exploring Claude Code extension poisoned with persistent SSH backdoor, why editors like Cursor use a separate extension store is explained in Open VSX.
Open VSX is an open-source registry of VS Code-compatible extensions hosted by the Eclipse Foundation, an alternative to Microsoft's marketplace, whose terms limit it to Microsoft products.
Wikipedia · Wade · 5 min
0