Tampered Claude Code extension on Cursor's marketplace tried to plant a backdoor

Cursor said that two versions of a Claude Code extension on its VS Code extension marketplace, 2.1.312 and 2.1.313, were malicious. In its security notice the company stated that the versions “were not developed by Anthropic”. They were downloadable from about 2:27am to 1:35pm Pacific time on 29 October, roughly 11 hours, according to Cursor. The notice is dated 29 October and was updated the next day.

Cursor said the code collected host details including hostname, username, operating system, home directory, environment variable names, Git email and public IP address. It then tried to add an attacker’s SSH key, enable the local SSH service and open a reverse SSH tunnel, with persistence set up through a macOS LaunchAgent or a Windows scheduled task. Cursor said the tunnel step usually fails because it needs administrator rights, but that the extension did add the key, install persistence and send the host details. It warned that uninstalling the extension may not be enough, because separate persistence scripts can keep running, and published indicators and clean-up scripts for macOS and Windows.

The Register reported that the endpoint-security firm Phorion first flagged the update, describing a backdoor for Windows, macOS and Linux; Cursor’s notice names macOS and Windows. Anthropic’s Felix Rieseberg said it “wasn’t a compromise of Anthropic’s systems or employee laptops,” that “a malicious actor used access to Cursor’s marketplace to publish a tampered copy,” and that versions on Anthropic’s official channels were unaffected. Cursor’s notice contains no statement from Anthropic.

Cursor said it removed the version on detection, shut the marketplace down as a precaution, found no other tampered extensions, rotated its keys before restoring it, and worked with the hosting provider to take the attacker’s server offline. Neither company had explained, in the sources reviewed, how the tampered package reached the marketplace. The Register also cited a figure of up to 5,000 infected developers, attributed to unnamed industry figures; neither Cursor’s notice nor the Register gave a basis for it, and it should be treated as unverified.

The incident is a software supply-chain case involving a coding agent’s extension rather than a flaw in an AI model. Both companies placed the point of compromise at Cursor’s marketplace, and how it happened remained open.