Cursor, the developer of the namesake code editor, detected and removed a modified version of the Claude Code extension, provided by Anthropic, which had the potential to affect up to five thousand users. This malicious package aimed to collect computer data and implant an SSH backdoor to enable remote access to the machine.
The corrupted version, identified as Anthropic.claude-code 2.1.313, was accessible on the platform's extension marketplace between 6:27 AM and 5:35 PM on October 29th, Brasília time. After becoming aware of the incident, the company, which has a stake in SpaceX owned by Elon Musk, removed the extension and temporarily suspended the marketplace's operation.
According to the company, no evidence of manipulation was found in other packages. Cursor also proceeded to rebuild the marketplace before reactivating it. Users who may have been impacted by this flaw should contact the platform directly.
The alert issued by Cursor clarifies that the harmful version was not created by Anthropic, but rather disguised itself as the Claude Code package, containing code capable of compromising the device of anyone who installed it. After installation, the software began collecting sensitive information, such as the user's and PC's name, operating system, processor architecture, working directories, Git email, and IP address.
Subsequently, the extension attempted to incorporate an SSH key controlled by the attacker, named svc-telemetry, aiming to create an entry point that could be used in the future. Using this same key, the malware sought to establish a reverse tunnel to an external server, which would give the attacker the ability to remotely access the machine.
To ensure the maintenance of this access even after restarts, the code implemented persistence mechanisms on both Windows and macOS. These routines were configured to attempt to reestablish the connection at intervals of approximately 60 seconds. Additionally, some of the collected information and the connection status with the server were transmitted to the infrastructure managed by the attacker.
However, the attempt at remote access was unsuccessful on most computers. The platform reported that the code had flaws and required elevated permissions to activate the SSH service. Thus, the risk was significantly higher only on equipment where administrator or root permissions were granted to Cursor. Even in these scenarios, the company advises that any individual who installed the compromised version perform a complete system check. This recommendation applies to anyone who installed or updated the Anthropic.claude-code extension to version 2.1.313 during the period it was available. One way to check the device is by looking for the svc-telemetry key, which was added by the malware in the SSH settings.
