Malicious Claude Code Extension Listed on Cursor Marketplace Attempts SSH Backdoor
AI coding · Enterprise AI
AI code editor Cursor announced that malicious versions of the Claude Code for VS Code extension (2.1.312 and 2.1.313) appeared on its marketplace on October 29, potentially affecting up to 5,000 users. The malware attempts to inject an attacker's SSH public key into authorized keys to create a backdoor. The extension was removed after roughly 11 hours, and Cursor urges users to update to version 2.1.314 and inspect their SSH keys.
AI code editor developer Cursor recently announced that its extension marketplace hosted compromised versions of the Claude Code for VS Code extension on October 29. The affected versions, 2.1.312 and 2.1.313, potentially impacted up to 5,000 developers before being removed approximately 11 hours after listing.\n\nCybersecurity firm Phorion revealed that once the editor loads the affected extension, the malicious payload automatically runs and attempts to append the attacker's SSH public key to the user's authorized keys file for unauthorized remote access. Simply uninstalling the extension may leave persistent configuration traces on the local machine.\n\nMicrosoft security researchers confirmed that these malicious versions were not distributed via the Microsoft Visual Studio Marketplace or the official NPM package, and Anthropic verified that its internal systems were not compromised. Cursor stated that the malicious code was not created by Anthropic, and other marketplace extensions remain unaffected. Cursor has reopened its marketplace after security verification, released clean version 2.1.314, and advised affected users to inspect their SSH authorized keys for unauthorized entries.
Key takeaways
- Compromised Claude Code extension versions (2.1.312 and 2.1.313) were listed on the Cursor marketplace for roughly 11 hours, potentially impacting 5,000 users.
- Security researchers noted the payload automatically injects an attacker's SSH public key into authorized keys to establish remote access, persisting even after uninstalling.
- Microsoft and Anthropic confirmed their official channels and systems were uncompromised; Cursor released version 2.1.314 alongside cleanup guidance.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.