Malicious versions of Anthropic’s Claude Code extension were distributed to Cursor users as part of a new software supply chain attack. The incident occurred on October 29, and the affected versions were only accessible for about 11 hours. They did not originate from Anthropic, which states its official channels are unaffected.
Versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension were available in Cursor’s VS Code extension marketplace. Targeting both macOS and Windows users, they contained JavaScript code designed to execute upon loading certain modules and set up a reverse SSH tunnel, providing remote access to the infected machine. According to security researcher Kevin Beaumont, around 5,000 developer systems may have downloaded these versions.
A modified copy published via Cursor’s marketplace
Anthropic stated that the modified versions were not developed by the company and were not published on the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry. “A malicious actor used access to Cursor’s marketplace to publish an altered copy of the Claude Code extension, which we did not build or publish. The versions from our official channels are unaffected, and this only impacts Cursor users,” said Felix Rieseberg of Anthropic. To avoid confusion, Anthropic directly updated its legitimate version of the extension to version 2.1.314.
On Cursor’s side, the modified extension was removed from the store as soon as it was identified, and the marketplace was suspended during the investigation. Cursor states it found no other malicious extensions, renewed all its keys, rebuilt and reopened the marketplace. The company also collaborated with the cloud provider hosting the attacker’s server to take it offline. “We have no evidence that other versions of the extension or the official distribution are affected,” Cursor clarified.
Information gathering and persistence actions
According to the analysis published by Microsoft, the JavaScript function executed upon loading collected information about the machine, modified files, and launched system commands. Microsoft states the code attempted to install an SSH key, enable the SSH service, create the tunnel, and configure its persistence, meaning its ability to remain active after a reboot. “The loader first collects information about the host. It then attempts to install an SSH key, enable SSH, create a reverse tunnel, and configure persistence. A deferred callback then attempts to send the host details,” Microsoft indicates. Researchers observed the collection of the hostname, username, operating system, architecture, working directory, and global Git email address, as well as the deployment of platform-specific scripts. According to Cursor, enabling the SSH service requires administrator privileges that the extension does not have on most macOS and Windows systems: this step therefore failed, which would have prevented the attackers from connecting via the tunnel.
Cursor recommends users remove the malicious versions as soon as possible and has published a detection script as well as indicators of compromise. The company notes that uninstalling the extension may not be sufficient, as the malicious payload drops standalone persistence scripts that continue to run.
