Cursor’s users recently became targets in a supply chain attack involving malicious versions of Anthropic’s Claude Code extension. The incident occurred on October 29, with compromised versions 2.1.312 and 2.1.313 appearing in the Cursor VS Code Extension Marketplace for around 11 hours.
Details of the Malicious Attack
The attack focused on both macOS and Windows platforms, embedding JavaScript code designed to activate a reverse SSH tunnel upon module loading. Approximately 5,000 developer systems potentially downloaded these harmful versions, according to security expert Kevin Beaumont.
These altered versions were not developed by Anthropic and were not distributed through the Microsoft Visual Studio Marketplace, Open VSX, or the NPM registry. Anthropic’s Felix Rieseberg clarified that a malicious actor exploited access to Cursor’s marketplace to distribute the tampered extension, ensuring that official channels remained unaffected.
Response and Mitigation Efforts
In response, Anthropic quickly updated its authentic Claude Code extension to version 2.1.314. Cursor acted promptly by removing the compromised extension from its store, suspending the marketplace to conduct a thorough investigation. The company confirmed no other malicious extensions were present, rotated all security keys, and reopened the marketplace after ensuring its integrity.
Additionally, Cursor collaborated with the cloud provider hosting the attacker’s server to take it offline. They assured that no evidence suggested other versions or official distributions were compromised.
Technical Insights and Security Recommendations
The malicious extension versions executed a JavaScript function during module loading, which gathered host information, modified files, and executed OS commands. According to Microsoft, the code collected data such as hostname, username, OS, system architecture, and more, while attempting to establish persistence via platform-specific scripts.
Due to administrative rights being required to enable the local SSH service, most attempts failed on macOS and Windows systems, thus preventing unauthorized access through the reverse tunnel. Users are advised to remove the malicious versions promptly. Cursor released a detection script and indicators of compromise (IoCs) to help identify potential breaches.
Users should isolate systems showing signs of payload execution or backdoor installation, remove unauthorized SSH keys, persistence mechanisms, and running tunnel processes, and determine if the host needs to be rebuilt. Simply uninstalling the extension might not suffice, as standalone persistence scripts may continue operating.
