A Tampered Claude Code Extension Sat in the Cursor Marketplace for 11 Hours

What the payload did

The researchers at Phorion and OpenSourceMalware found the attacker had prepended a loader to the extension's extension.js and left the rest of the bundle unchanged. Phorion's CEO told Help Net Security that the code "executes as soon as Node loads the file, before the extension's normal activate callback even runs." Nobody had to open Claude Code for it to fire. According to Cursor, it:

• reported the hostname, username, OS, home and working directories, Git email, public IP and the names of environment variables to the attacker's server;
• added an attacker key labelled svc-telemetry to authorized_keys, tried to enable the local SSH service and opened a reverse SSH tunnel;
• installed persistence through a LaunchAgent on macOS or a scheduled task with a Startup-folder fallback on Windows, retrying the tunnel about every 60 seconds.

Two bugs limited the damage. On macOS the script checked Remote Login without admin rights, got an error instead of "Off", and skipped enabling SSH. On Windows it tried to install OpenSSH through /bin/sh. Cursor says that outside "highly unusual circumstances where Cursor was started with administrator privileges" the SSH step failed, so the attacker could not log in through the tunnel. The key, the persistence and the reconnaissance report still landed. Phorion warned that a Mac with Remote Login already on, or turned on later, is reachable.

What Cursor did, and what is still unknown

Cursor removed the versions, shut its whole marketplace down, audited access, rotated its keys, rebuilt the marketplace and had the attacker's server taken offline. It found no other tampered extensions. It published hashes, a check for the svc-telemetry key and remediation scripts, and warns that "Uninstalling the extension may not be sufficient" because the persistence scripts run on their own.

What remains uncertain. Nobody has said how the attacker got a package published under Anthropic's name. Early reports differ on scope: Help Net Security says Phorion first spotted the package on Open VSX, while BleepingComputer says it was later confirmed that Cursor was the only source. Cursor's figure of 5,000 is a ceiling, not a count of infected machines.

Analysis: An editor extension runs with the developer's full rights, and a well-known publisher name in a marketplace is a label, not a proof of origin. Editors built on the open-source VS Code code cannot use Microsoft's marketplace, so they depend on a second distribution channel with its own controls. For Belgavi's Book Store, Tanishka could pin extension versions for the help-desk developers, compare the publisher and hash of agent extensions with the vendor's own release, and alert on new authorized_keys entries and new LaunchAgents or scheduled tasks. Each of those checks would have caught this payload even though the bugs in it did not stop the persistence.

Sources and evidence

• Malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (Cursor, October 29)
• Malicious Claude Code extension on Cursor planted SSH backdoors (BleepingComputer, October 30)
• Claude Code extension poisoned with persistent SSH backdoor (Help Net Security, October 30)