Malicious Claude Code Extension Served in Cursor Supply Chain Attack

What it is

Versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension were tampered copies published through Cursor's own marketplace on October 29. Anthropic's Felix Rieseberg says a malicious actor used access to Cursor's marketplace and that Anthropic neither built nor published these versions. They were live for roughly 11 hours. Kevin Beaumont estimates about 5,000 developer systems may have downloaded them.

Preconditions / Affected

Only Cursor users who installed 2.1.312 or 2.1.313 are affected. Per Anthropic and Cursor, the Microsoft Visual Studio Marketplace, Open VSX and the NPM registry were not affected, and Cursor has no evidence that other versions or the official distribution were. Anthropic moved its legitimate extension to 2.1.314 to avoid confusion. Cursor found no other malicious extensions.

How it works

A JavaScript function ran at module load on macOS and Windows. Microsoft describes the sequence: host reconnaissance, an attempt to install an SSH key, enabling SSH, creating a reverse tunnel, and configuring persistence. A delayed callback then tried to send host details. The code was seen collecting hostname, username, OS, architecture, working directory and global Git email, and deploying platform-specific scripts and startup configurations.

flowchart TD
    A[Extension loads] --> B[Recon and persistence scripts]
    B --> C{Admin rights?}
    C -->|Usually no| D[SSH enable fails, no login via tunnel]
    C -->|Yes| E[Tunnel may give attacker access]

What to do

• Remove versions 2.1.312 and 2.1.313 as soon as possible.
• Run the detection script Cursor released and check environments against Cursor's published IoCs.
• Isolate hosts that show payload execution or backdoor installation.
• On those hosts, remove the unauthorized SSH key, the persistence mechanisms and any running tunnel processes, then decide whether to rebuild the host.
• Do not treat uninstalling as sufficient. The payload drops standalone persistence scripts that keep running.

Caveats

The page does not give the script's name or the IoC values, so fetch them from Cursor's advisory. According to Cursor, enabling the local SSH service needs admin rights that the extension lacks on most macOS and Windows systems, so that step failed and attackers could not log in through the tunnel. The recon data may still have been sent, and hosts where the extension did have admin rights are not covered by that reassurance. Cursor rotated all keys, rebuilt and reopened the marketplace, and worked with the attacker's cloud provider to take the server offline. The page does not say how the attacker obtained marketplace access.