Malicious Claude Code Plugin in Cursor Marketplace Installs SSH Backdoors
A tampered version of the Claude Code extension was briefly available on Cursor's official marketplace, attempting to install persistent SSH backdoors and steal sensitive data from approximately 5,000 developers over an 11-hour window. Although configuration errors prevented successful remote access on many devices, the incident highlights security risks in the AI agent plugin ecosystem. Cursor has since removed the malicious extension and temporarily suspended the marketplace for a comprehensive audit.
Full Report
IT Home reported on October 31 that tech media outlet BleepingComputer published a post yesterday (October 30) revealing that the Cursor plugin marketplace hosted a tampered version of the Anthropic Claude Code extension starting on October 29. The malicious extension remained active for approximately 11 hours, affecting around 5,000 developers worldwide.
Note from IT Home: The Cursor Marketplace is the official platform for discovering, installing, and managing plugins. It allows Cursor’s AI Agent to integrate with external tools, data sources, and workflows.
According to the report, the malicious version of Claude Code was numbered 2.1.313. It was distributed for about 11 hours between 2 AM and 1 PM Pacific Time (from 17 on October 29 to 04 on October 30 Beijing Time), potentially downloaded by up to 5,000 developers.
Cursor has confirmed that the malware attempted to install a persistent SSH backdoor on user devices. Security researchers found that the attackers did not modify the original legitimate functional code; instead, they inserted a malicious JavaScript loader at the beginning of the extension’s extension.js file.
Once developers installed this malicious version of Claude Code, the harmful code executed automatically without requiring any interaction with Claude Code itself. The malware collected usernames, hostnames, public IP addresses, Git email addresses, and environment variable names related to sensitive credentials, sending this information to attacker-controlled servers.
Additionally, it added SSH keys controlled by the attackers, attempted to enable SSH access, established reverse tunnels, and achieved persistence via macOS LaunchAgents or Windows scheduled tasks and startup scripts, retrying connections approximately every minute.
However, due to obvious errors in the SSH configuration logic, many Windows and macOS devices likely failed to have remote access successfully enabled. For instance, on macOS, the check command was not executed with administrator privileges; on Windows, it incorrectly invoked the Unix shell /bin/sh.
Cursor has removed the malicious extension and temporarily shut down the entire extension marketplace to audit other plugins and rotate access keys. The company also coordinated with hosting providers to take down the attacker’s servers, cutting off reverse SSH connections and data exfiltration channels.
Cursor stated that no other extension versions or official distribution channels were affected but has not yet explained how the attackers managed to publish the tampered package under Anthropic’s name.