A tampered version of an official AI development extension on Cursor exposed thousands of developer systems to malicious compromise. The supply chain incident ran for roughly 11 hours and threatened as many as 5,000 user machines across multiple operating systems, BleepingComputer reported.
Key Facts
- A tampered Claude Code extension version 2.1.313 affected up to 5,000 users.
- The malicious package was live in the Cursor marketplace for about 11 hours.
- The malware attempted to plant persistent SSH backdoors on Windows, macOS, and Linux.
- Coding flaws in the script prevented the SSH remote access from functioning on many target machines.
The rogue software was identified as version 2.1.313 of the Claude Code extension, which integrates AI coding assistance directly into compatible code editors. Ars Technica reported that the malicious package was distributed through Cursor's extension marketplace between the early hours and afternoon. Security researchers from Phorion discovered that attackers inserted a malicious JavaScript loader at the beginning of the extension file while leaving the legitimate underlying code intact. When the extension loaded, the script executed automatically without requiring any direct interaction from the user.
Once installed, the compromised extension attempted to install a persistent SSH backdoor by adding an attacker-controlled SSH key, enabling the local service, and opening a reverse SSH tunnel. The payload was engineered to operate on Windows, macOS, and Linux platforms. Because Cursor extensions execute with the same permissions as the integrated development environment, the rogue version gained potential access to local source code, developer tooling, and sensitive files.
Despite the dangerous design, coding errors in the malware hindered its execution across various systems. As noted by Wired, a flaw in the payload blocked it from fully establishing itself on the vast majority of target devices. On macOS, the malware tried to check remote login status without administrative privileges, causing the activation step to fail. On Windows, the script attempted to start the OpenSSH server through a Unix shell that standard Windows installations do not possess.
Even though the remote access backdoor failed in these cases, the malware still transmitted reconnaissance data back to the operator. BleepingComputer reported that the script gathered usernames, hostnames, public IP addresses, Git email addresses, and environment variable names linked to sensitive credentials. Phorion observed that this reconnaissance allowed the operator to quickly inventory cloud tokens and API credentials stored on the machine.
Response and Attribution Questions
Cursor personnel responded by collaborating with the hosting provider that operated the server connected by the reverse shell, ensuring infected devices could no longer reach it. The platform also removed the tainted version from the marketplace and temporarily shut down the entire extension marketplace to rotate access keys and audit controls. Cursor stated that its internal investigation found no other extension versions were impacted by the event.
Questions regarding the origin of the malicious upload remain unanswered by the platform and Anthropic. Independent researchers and staff members at Anthropic clarified that the compromise did not originate from Anthropic systems or employee developer laptops. Felix Rieseberg of Anthropic stated on social media that a malicious actor used access to the Cursor marketplace to publish a tampered copy of the extension, which Anthropic did not build or publish. Wired noted that Cursor did not return requests for comment regarding how the unauthorized upload occurred.
Background
Cursor is an AI-powered code editor built from Microsoft's open-source Visual Studio Code that supports standard extensions. Anthropic provides an official extension for its Claude models to assist developers with natural-language coding tasks inside compatible environments.
Security analysts at Phorion first spotted the malicious package after detecting unusual activity on a customer machine. The incident highlights ongoing risks within software supply chains where third-party distribution channels can be leveraged to distribute malware directly to active developer environments.
Why It Matters
Software supply chain attacks targeting developer environments can give threat actors deep footholds inside corporate and personal networks. While coding bugs blunted the immediate impact of this specific incident, affected developers are advised to isolate machines, rotate secrets, and rebuild environments from safe backups to mitigate lingering risks.
Illustration: AI-generated image, not a photograph of the event.