Developers using the **Cursor** AI-powered code editor were recently targeted in a supply chain attack involving a compromised version of the **Anthropic Claude Code** extension. ### Supply Chain Attack Unveiled On October 29, a malicious variant of the **Claude Code** extension, identified as version 2.1.313, was available on the **Cursor** marketplace for approximately 11 hours. This window, between 2:27 a.m. and 1:35 p.m. Pacific Time, potentially exposed up to 5,000 developers to malware designed to establish persistent SSH backdoors. **Cursor**, an AI-powered code editor built on **Microsoft**'s open-source **Visual Studio Code (VS Code)**, supports **VS Code** extensions. **Anthropic**'s legitimate **Claude Code** extension integrates its AI coding assistant directly into compatible editors, aiding developers with code writing and debugging. While **Cursor** confirmed that **Anthropic** did not develop the malicious extension, the mechanism by which attackers managed to distribute the compromised package under **Anthropic**'s name remains unclear. ### Malware's Modus Operandi Researchers at **Phorion** and **OpenSourceMalware** analyzed the compromised extension. They discovered that attackers injected a malicious JavaScript loader at the beginning of the `extension.js` file, leaving the legitimate extension code largely untouched. This malicious code executed automatically when the extension loaded, requiring no user interaction with **Claude Code**. Upon installation, the malware performed several actions on affected systems: * **Information Gathering**: Collected system and user details, including Git email and public IP address. * **SSH Backdoor Attempt**: Added an attacker-controlled SSH key, attempted to enable SSH access, and establish a reverse tunnel. * **Persistence**: Installed persistence through a **macOS LaunchAgent** or **Windows** scheduled task/Startup script, with attempts to re-establish the tunnel approximately every minute. * **Exfiltration**: Sent host details and backdoor status to the attacker’s server at `134.209.82[.]225`. .jpg) *Source: OpenSourceMalware* ### Flawed Execution Limits Impact Despite its sophisticated design, coding errors in the malware's SSH setup routines likely prevented attackers from gaining full remote access to many affected **Windows** and **macOS** systems, according to **Phorion**. The critical flaw lay in the malware's inability to enable SSH on machines where it wasn't already running. This rendered the reverse tunnel ineffective in providing access to the compromised device. On **macOS**, the malware attempted to check if Remote Login was enabled using the `systemsetup -getremotelogin` command. However, it executed this command without elevated privileges, resulting in an administrator-access error instead of returning the SSH service's status. As the malware only attempted to enable SSH if the output contained "Off," it bypassed the activation step entirely. On **Windows**, the malware tried to install and start the **OpenSSH** server via PowerShell but erroneously attempted this through `/bin/sh`, a Unix shell not present on standard **Windows** installations. This error led to the failure of the SSH setup. In both scenarios, while the malware successfully installed its SSH keys, established persistence, and attempted to create the reverse tunnel, the absence of a running SSH server prevented the tunnel from providing access to the compromised machine. Even without successful backdoor access, the malware still exfiltrated reconnaissance data to the attacker's server. This included the victim's username, hostname, public IP address, Git email address, and names of environment variables potentially associated with sensitive credentials. The lack of direct credential theft suggests attackers intended to manually retrieve sensitive data post-SSH access. ### Remediation and Lingering Questions **Cursor** swiftly removed the malicious extension and temporarily shut down its entire marketplace for an audit. The company also rotated all access keys before restoring service. Additionally, **Cursor** collaborated with the hosting provider to take the attacker's server offline, disrupting both the reverse SSH connections and data exfiltration. An internal investigation by **Cursor** found no evidence that other extension versions or the official distribution were affected. Initial reports suggesting impact on **npm**, **Open VSX**, and **Microsoft**'s **Visual Studio Code Marketplace** were later refuted, confirming **Cursor** as the sole distribution point for the malicious extension. Developers who downloaded the package during the exposure window are advised to check for the presence of an 'svc-telemetry' SSH key on their machines. **Cursor** has provided remediation instructions, which include isolating affected machines, rotating accessible secrets, invalidating sessions, and rebuilding the environment from secure backups. Despite these measures, significant questions remain regarding the supply chain attack. The primary unknowns include how threat actors managed to publish a malicious extension under **Anthropic**'s name on **Cursor**'s marketplace and whether **Cursor** or **Anthropic**'s systems were compromised during the incident. Ghost Protocol has reached out to both companies for further comment.