Attackers target Cursor marketplace with tainted Claude Code extension

A malicious version of the Claude Code extension for Visual Studio Code was distributed through Cursor's extension marketplace on Thursday, exposing up to 5,000 developers. The compromised package, labeled version 2.1.313, was available for roughly 11 hours between 0227 and 1335 PT (0927 and 2035 UTC) before being taken down. Anthropic stated that the breach did not involve its own systems or employee hardware, clarifying that an attacker used access to Cursor's marketplace to upload the altered copy. [1][2]

First identified by EDR vendor Phorion, the modified extension ran a hidden JavaScript loader designed to plant persistent SSH backdoors on Windows, macOS, and Linux systems without requiring user interaction. It also harvested victim details, including usernames, public IP addresses, and configured Git emails, transmitting them to an attacker server. However, researchers noted that implementation errors frequently crippled the backdoor: the setup script lacked necessary administrative privileges on macOS and attempted to call a Unix shell not present on standard Windows systems, blocking reverse SSH tunnels on machines where SSH was not already running. [1][2]

Cursor briefly shut down its marketplace to audit other offerings and rotated its internal access keys before bringing the platform back online. The company also collaborated with a hosting provider to sever ties to the command server. Because the extension drops an SSH key and configures persistence via startup mechanisms, simply upgrading does not clean an infected system, prompting Cursor to distribute specific remediation scripts for affected developers. [1][2]