Cursor Marketplace Supply-Chain Attack Exposed Developers to SSH Backdoor

A supply-chain attack targeting developers briefly turned a trusted AI coding assistant into a malware delivery mechanism after malicious versions of Anthropic's Claude Code extension were distributed through Cursor's extension marketplace. The trojanized packages targeted Windows and macOS users, collecting device information, planting unauthorized SSH keys, establishing persistence mechanisms, and attempting to create remote access channels back to attacker-controlled infrastructure.

The incident involved malicious versions 2.1.312 and 2.1.313 of the Claude Code extension, which were available through Cursor's marketplace for approximately 11 hours on October 29. Because the compromised packages used Anthropic's legitimate extension identifier, developers installing or updating the extension had little reason to suspect anything was wrong. Both Cursor and Anthropic confirmed that the attack was limited to Cursor's marketplace and did not affect Anthropic's infrastructure, Microsoft's Visual Studio Marketplace, Open VSX, or the official Claude Code npm package.

Security researchers discovered that attackers inserted a malicious JavaScript loader into an otherwise legitimate extension package. Analysis found that the attackers preserved the genuine Claude Code functionality while embedding a small amount of malicious code designed to execute before the extension's normal startup process. Because the authentic extension components remained intact, the trojanized version closely resembled a legitimate software update and was difficult for users to identify through normal inspection.

Once activated, the malware gathered information about the host system, including usernames, hostnames, operating system details, processor architecture, public IP addresses, home directory locations, Git configuration information, working directories, and environment variable data. Researchers believe the collected information was intended to help attackers identify valuable targets and determine whether compromised systems contained useful development assets or privileged access.

The malware's primary objective was to establish persistent SSH access to affected developer workstations. To accomplish this, it attempted to add an attacker-controlled SSH public key to the victim's authorized_keys file, enable local SSH services, and establish reverse SSH tunnels capable of providing remote access. Security experts noted that developer systems are particularly attractive targets because they frequently contain source code repositories, cloud credentials, API tokens, package-signing certificates, and access to production environments that can be leveraged in follow-on attacks.

Researchers also identified several persistence mechanisms designed to survive reboots and extension removal. On macOS, the malware deployed LaunchAgent entries intended to automatically re-establish communications with attacker-controlled infrastructure. On Windows, it attempted to create a scheduled task disguised as a system monitoring process named "SysMon" while also leveraging Startup-folder scripts as a fallback persistence method. Investigators warned that these artifacts existed outside the extension installation directory, meaning simply uninstalling the extension would not completely remove the compromise.

Fortunately, coding mistakes and operating system privilege restrictions appear to have reduced the attack's effectiveness on many devices. Cursor reported that enabling local SSH services generally required administrator privileges that the malicious extension did not possess on most Windows and macOS systems. However, security researchers cautioned that even where remote-access attempts failed, affected machines could still contain unauthorized SSH keys, persistence mechanisms, and evidence of information collection activity.

The incident highlights the growing threat posed by software supply-chain attacks targeting developer ecosystems and AI-powered coding tools. Rather than exploiting a software vulnerability, attackers abused trust in a legitimate extension and its update mechanism. As organizations increasingly adopt AI-assisted development tools, security teams face growing pressure to monitor software supply chains, verify extension integrity, and rapidly detect unauthorized modifications before they reach production environments.

Cursor has since removed the malicious packages, temporarily shut down its marketplace, rotated credentials, rebuilt marketplace infrastructure, and worked with hosting providers to disable the attacker's servers. Security experts recommend that potentially affected users remove unauthorized SSH keys and persistence artifacts, rotate credentials from a trusted device, review endpoint telemetry for signs of compromise, and determine whether impacted systems require a full rebuild. The incident serves as a reminder that trusted developer tools remain an increasingly valuable target for threat actors seeking access to enterprise environments.