A fake Claude Code extension on Cursor's marketplace tried to install SSH backdoors on developers' machines

Cursor has published a security notice saying that maliciously modified versions of the Anthropic.claude-code extension were available in its VS Code Extension Marketplace on October 29, between about 2:27 a.m. and 1:35 p.m. Pacific Time. The notice names versions 2.1.312 and 2.1.313 for Windows and macOS and says Anthropic did not develop them. According to Cursor, the code collected host and user details: hostname, username, operating system, architecture, home directory path, environment variable names, working directories, configured Git email and public IP address. It then tried to add an attacker-controlled SSH key to authorized_keys, turn on the local SSH service and open a reverse SSH tunnel. BleepingComputer reports that up to 5,000 developers may have been exposed during the roughly 11-hour window. It cites researchers at Phorion and OpenSourceMalware, who found that the attackers added a malicious JavaScript loader to the start of the extension.js file and left the rest of the legitimate code unchanged. Cursor has not said how the attackers got a tampered package published under Anthropic's name. The Hacker News also reported the incident. Cursor's notice explains how to check whether a machine is affected and how to clean it, and it lists indicators of compromise. Developers who installed either version should treat the machine as compromised. A persistent SSH key and a reverse tunnel can give an attacker remote access that survives removing the extension.