Cursor Extension Store Targeted by Supply Chain Attack: Claude Code Backdoored with SSH Backdoor, Affecting Up to 5,000 Users

Beating AI News Flash: Cursor disclosed that on October 29, a maliciously tampered version of Claude Code 2.1.313 appeared in its extension marketplace. This installation package was not created by Anthropic and was listed in the store for about 11 hours. Cursor estimates that up to 5,000 users may be affected and will contact them directly.

Security research firm OpenSourceMalware found in its analysis that the attacker inserted 66 lines of malicious code before the plugin's normal code. As soon as the editor loads the extension, the code executes, even without the user chatting with Claude.

The malicious program collects information such as the computer name, Git email, and public IP address, and also secretly adds the attacker's key to the SSH authorized list. It then attempts to enable remote login, connect to the attacker's server through a reverse SSH tunnel, and set up a background task that runs automatically at startup, attempting to reconnect about every 60 seconds.

However, the attack code itself contains errors. Cursor said most Mac and Windows computers did not grant it the administrator privileges needed to enable the SSH service, so the attacker usually cannot log in through the tunnel. But adding malicious keys, installing background scripts, and sending device information may still succeed. Computers that already have the SSH service enabled should not be considered safe because of this.

Cursor has removed the malicious version, temporarily shut down the entire extension marketplace, and helped shut down the attacker's server. Affected users need to check whether `svc-telemetry` exists in the SSH authorized file and clean it up using the official remediation script. Uninstalling the extension alone is not enough; the background backdoor may continue to run.