started · updated
Cursor marketplace compromise affects up to 5,000 developers
A malicious version of the Anthropic Claude Code extension was distributed through the Cursor AI code editor marketplace for approximately 11 hours on October 29. The compromised version, identified as 2.1.313, was available for Windows, macOS, and Linux users between 02:27 and 13:35 PT.
Researchers discovered that the extension contained a 66-line JavaScript loader designed to install a persistent SSH backdoor. The malware attempted to collect system information, including usernames, hostnames, public IP addresses, and Git email addresses, while also attempting to exfiltrate environment variables related to cloud services like AWS and GCP. The code tried to establish a reverse SSH tunnel to an attacker-controlled server.
Cursor reported that at most 5,000 users were affected. While the malware contained flaws that prevented successful SSH tunneling on many systems without administrator privileges, it could still collect data and install unauthorized SSH keys. Cursor temporarily shut down its marketplace, rotated keys, and worked with hosting providers to take down the attacker's server.
Anthropic clarified that its own systems and employee devices were not compromised. Instead, a malicious actor gained access to the official Anthropic account within the Cursor marketplace to publish the tampered version. The legitimate Claude Code extension has since been updated to version 2.1.314.
Entities
Anthropic · Claude Code · Cursor · Phorion · SpaceX
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 7 SOURCES] The malware collected system information including usernames, hostnames, public IP addresses, and Git email addresses. dijitaliyidir.com · cryptocompass.com · borncity.com · www.cryptopolitan.com · www.ithome.com · +2 more
- [● 2 SOURCES] The malicious version was identified as 2.1.313 and was replaced by version 2.1.314. www.it-boltwise.de · arstechnica.com
- [● 11 SOURCES] A malicious version of the Claude Code extension (2.1.313) was available on the Cursor marketplace for approximately 11 hours on October 29. dijitaliyidir.com · cryptocompass.com · www.breezyscroll.com · www.it-boltwise.de · stiintasitehnica.com · +5 more
- [● 5 SOURCES] Anthropic stated that its own systems and employee laptops were not compromised during the incident. dijitaliyidir.com · cryptocompass.com · www.breezyscroll.com · www.theregister.com
- [● 10 SOURCES] The malicious extension attempted to install an SSH backdoor on Windows, macOS, and Linux systems. dijitaliyidir.com · cryptocompass.com · www.breezyscroll.com · stiintasitehnica.com · borncity.com · +4 more
- [● 8 SOURCES] The SSH backdoor attempt often failed on Windows and macOS because it lacked administrator privileges. dijitaliyidir.com · cryptocompass.com · stiintasitehnica.com · www.cryptopolitan.com · www.ithome.com · +2 more
- [● 3 SOURCES] The malicious extension was published using the official Anthropic account on the Cursor marketplace. dijitaliyidir.com · www.breezyscroll.com · arstechnica.com
- [● 2 SOURCES] Cursor responded by taking its marketplace offline, rotating keys, and rebuilding the marketplace. www.breezyscroll.com · stiintasitehnica.com