Phorion researchers found a malicious backdoor in the official Claude Code extension for VS Code on the Cursor Marketplace. The compromised versions 2.1.312 and 2.1.313 dropped a persistent SSH backdoor across macOS, Linux, and Windows systems. The malware runs malicious code immediately upon loading the extension before the normal activation callback.
The malicious code attempts to collect host information, add attacker-controlled SSH keys, and open reverse SSH tunnels to a command and control server. It establishes persistence via LaunchAgent on macOS or scheduled tasks on Windows. Cursor removed the malicious versions from its marketplace, though systems may remain infected.
Anthropic released a patched version 2.1.314 to replace the backdoored bundle. The attack exploited a supply chain compromise via Cursor’s marketplace, not Anthropic’s internal systems. Developers using the extension should update to the patched version immediately to prevent unauthorized access to their development environments.
