Users of the AI-powered code editor Cursor fell victim to a software supply chain attack involving malicious versions of the Claude Code extension by Anthropic uploaded to the editor's marketplace, remaining active for nearly 11 hours before being discovered and removed.
According to technical data, the incident involved versions 2.1.312 and 2.1.313 of the extension bearing the identifier anthropic.claude-code. Security researcher Kevin Beaumont estimated that the malware may have been distributed to approximately 5,000 developer machines running macOS and Windows environments prior to its removal.
Attack Mechanism and Espionage Attempts
The attackers relied on embedding JavaScript code that executed automatically once the extension packages were loaded inside the editor. The initial phase of the attack focused on surveying the programming environment by gathering sensitive information about the host system, including:
- Hostname, username, operating system type, and architecture.
- Working directory path.
- The globally registered email address in the Git version control tool.
Analyses, including findings monitored by Microsoft, revealed that the code subsequently attempted to install an SSH key, activate a local SSH server on the victim's device, and establish a reverse SSH tunnel allowing attackers to bypass firewalls, alongside planting auto-start files to ensure persistence even after system reboots.
Failure of Complete Breach and Response Measures
Cursor management confirmed that the attackers' attempt to control systems via the SSH tunnel did not fully succeed in most cases; activating the local SSH service requires administrator or root privileges that the extension does not possess by default on most macOS and Windows devices, preventing attackers from completing the remote login step.
Meanwhile, Anthropic clarified through its engineer Felix Rieseberg that the fake copies were not developed or published by the company, and were not released on other official stores such as the Visual Studio Marketplace, Open VSX, or the NPM registry. To avoid any overlap in version numbers, Anthropic directly bumped its official version number to 2.1.314.
Containment Steps and What Developers Should Do
The Cursor platform swiftly removed the two suspicious extensions and temporarily suspended the marketplace for review. It also rotated all security keys and rebuilt the marketplace environment prior to reopening, while coordinating with the cloud hosting provider to shut down the command and control server used by the attackers.
The company emphasized that merely uninstalling the extension from the editor may not be sufficient to clean an infected system, as the malicious payload creates independent scripts to establish persistence within the system. Cursor provided a scanning script along with Indicators of Compromise (IoCs), recommending the isolation of suspected devices, wiping unauthorized SSH keys, terminating active tunneling routes, and evaluating the need for a full system re-initialization to ensure the complete elimination of any malware traces.