A malicious version of the Claude Code extension was discovered in the Cursor extension marketplace, exposing users to an SSH backdoor. The package, identified as version 2.1.313, was distributed for roughly 11 hours on October 29 and may have reached up to 5000 users before removal.
The extension was not created by Anthropic. Instead, it gathered detailed system and user information, including the machine's IP address and the email configured in Git settings. It then added an attacker-controlled SSH key and attempted to establish remote access with persistence mechanisms on the compromised system.
Some users avoided full compromise because the backdoor required administrative privileges that were not always present. Nevertheless, the collection of machine data, installation of foreign SSH keys, and execution of background scripts still posed a serious risk even without successful remote access.
Cursor promptly removed the malicious package, conducted a review of other extensions, and arranged for the attackers' command server to be taken offline. Security teams recommend that affected users thoroughly remove any leftover scripts and change credentials from a trusted device, as simply uninstalling the extension is insufficient to eliminate the threat.
