Cursor Discloses Malicious Extension Incident: SSH Backdoor Planted in Claude Code Plugin Potentially Affecting Up to 5,000 Users

AI code editor vendor Cursor recently announced that its extension marketplace hosted a compromised "Claude Code for VS Code" extension on October 29. Attackers attempted to establish SSH backdoors on developers' computers. The affected versions were 2.1.312 and 2.1.313, potentially impacting up to 5,000 users. The malicious versions were removed approximately 11 hours after being listed.

According to security research firm Phorion, when users launched the editor and loaded the affected extension, the malicious code executed automatically, attempting to add the attacker's SSH public key to the computer's authorized_keys file. This allowed attackers to remotely access the computer via SSH later. Even if the extension was removed, malicious components could remain on the computer.

Regarding the distribution scope, Microsoft security researchers confirmed that these malicious versions were not distributed through the Microsoft Visual Studio Marketplace or the NPM package @anthropic-ai/claude-code. Microsoft also stated that Anthropic had confirmed to them that their company systems were not compromised in this incident.

Cursor further explained on its official X account that the injected malicious code was not developed by Anthropic, and other extensions downloaded from the Cursor marketplace were unaffected. Cursor collaborated with relevant parties to handle the malware, reopened the extension marketplace after completing security checks, and required all customers to update Claude Code for VS Code to version 2.1.314. Enterprises that installed or auto-updated to the affected versions via the Cursor marketplace should still check their computers' SSH authorized keys files to confirm whether any attacker public keys or other malicious components remain.