An official Anthropic Claude extension for VS Code was compromised and distributed through the Cursor marketplace, potentially affecting as many as 5,000 developers. The backdoored extension, identified as version 2.1.313, was made available through Anthropic’s verified account on Cursor before being replaced with a patched version 2.1.314 several hours later. Researchers determined that extensions auto-update by default in Cursor, meaning many users may have received the malicious software without taking explicit action.
The compromised extension was designed to establish a persistent SSH backdoor on affected systems by installing an attacker-controlled SSH key, enabling local SSH services, and creating a reverse SSH tunnel. The malicious code targeted Windows, macOS, and Linux platforms. Once installed, the extension would operate with the permissions of the integrated development environment, potentially granting access to local files, source code, developer tools, and sensitive information stored on the device. Security researchers identified capabilities including the extraction of variable names, which could allow attackers to identify and prioritize valuable targets like cloud credentials and API tokens.
Cursor reported that implementation flaws in the Windows and macOS versions of the malware limited its effectiveness in some instances, though researchers noted the threat remained significant due to its persistence mechanisms and reconnaissance capabilities. Cursor personnel worked with the hosting provider to disable communications from infected devices to the attacker’s infrastructure and removed the compromised extension from the marketplace. The VSCode Marketplace was temporarily shut down to rotate keys and audit access controls before being restored.
Developers who installed or updated the extension between 5:27 am ET and 4:35 pm on Thursday should consider themselves potentially affected. Both Cursor and security researchers have published indicators of compromise to aid in detection efforts. However, neither Anthropic nor Cursor has provided public explanation of how attackers gained access to the official account, and Anthropic has not issued a public warning to affected users.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI