Supply Chain Attack Targets Claude Code Extension, Exposing 5,000 Developers to SSH Backdoor

Malicious Anthropic Claude Extension Distributed Through Cursor Marketplace

A supply chain attack compromised the Claude Code extension on Cursor's VS Code extension marketplace for approximately 11 hours on October 29, 20261

1

. The malicious extension, identified as version 2.1.313, was available between 2:27 a.m. and 1:35 p.m. Pacific Time and reached up to 5,000 users3

3

. Cursor, the AI-powered code editor owned by SpaceX, immediately removed the compromised extension and temporarily shut down its entire marketplace to investigate the incident1

1

.

The compromised VS Code extension was designed to plant a persistent SSH backdoor on infected systems, giving attackers potential remote access to developer machines. Security researchers at Phorion first detected the malware on a customer's Mac, prompting immediate investigation1

1

. Calum Hall, cofounder and CEO of Phorion, stated: "Everyone was so lucky here, this was potentially a really dangerous foothold for an attacker"1

1

.

How the SSH Backdoor Malware Operated

The malicious extension contained a 66-line loader inserted before the legitimate extension code2

2

. When activated, the malware executed multiple operations to establish unauthorized remote access. It added an attacker-controlled key labeled "svc-telemetry" to the user's ~/.ssh/authorized_keys file, attempting to disguise it as a legitimate service2

2

.

The malware then attempted to enable SSH services across Windows, Linux, and macOS systems, establish a reverse tunnel to the command-and-control server at 134.209.82[.]225, and install platform-specific persistence mechanisms including scheduled tasks, crontab entries, and LaunchAgent files2

2

. Additionally, it transmitted host reconnaissance data to 134.209.82[.]225:8099 via unencrypted HTTP requests2

2

.

The collected data included public IP addresses from api.ipify[.]org, hostname and local username, operating system and CPU architecture, home directory and current working directory, global Git email from git config, and names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP2

2

. Security researcher Paul McCarty noted that while environment variable values weren't directly transmitted, "their names can still reveal which cloud providers, CI systems, and credential types are configured"2

2

.

Critical Coding Errors Limited Backdoor Success

Despite the sophisticated attack, coding errors in the malware prevented the SSH backdoor from functioning on most systems. Cursor confirmed that "turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts"2

2

. On macOS, the malware attempted to check Remote Login status using systemsetup -getremotelogin without elevated privileges, causing an administrator-access error that prevented SSH activation3

3

.

On Windows systems, the malware tried to install OpenSSH server through PowerShell but attempted to do so via /bin/sh, a Unix shell unavailable on standard Windows installations3

3

. These mistakes prevented the reverse tunnel from providing remote access to compromised machines. However, the malware still successfully installed SSH keys, established persistence mechanisms, and transmitted reconnaissance data to attackers3

3

.

Unclear Attack Vector Raises AI Security Risk Concerns

The method by which attackers published the malicious extension under Anthropic's name remains unclear. Initial speculation suggested a compromise of Anthropic systems, but the company firmly denied this. Felix Rieseberg from Anthropic's technical staff stated: "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension, which we didn't build or publish"1

1

.

However, Luke Roberts, co-founder and CTO of Phorion, told Ars Technica that "the malicious version 2.1.313 was posted to the official Anthropic account"4

4

. This contradiction highlights significant questions about how attackers gained access to publish under Anthropic's credentials. Cursor did not respond to requests for comment about whether the incident resulted from a breach at Cursor1

1

.

Growing Vulnerabilities in AI-Powered Development Tools

This supply chain attack exposes critical vulnerabilities in third-party AI tool integrations and AI coding tools that have become embedded in developer workflows. Extensions typically update automatically in Cursor by default, meaning developers could have received the malware without any action beyond having auto-updates enabled4

4

.

Eerke Boiten, professor of cybersecurity at De Montfort University, expressed concern about the broader implications: "The scenario of Claude sending out poisoned agents everywhere makes me even more worried than I already was"5

5

. The incident follows similar supply chain attacks on developer tools, including the GlassWorm operation that compromised OVHcloud's official CLI in March 20262

2

.

Immediate Response and Remediation Steps

Cursor worked with the hosting provider to take the attacker's server offline, disrupting both reverse SSH connections and reconnaissance data transmission3

3

. The company rotated all access keys before reopening the Cursor marketplace and found no evidence that other extensions were affected3

3

.

Anthropic published a clean version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace as of October 30, 20262

2

. Cursor is reaching out directly to impacted users and has published remediation steps2

2

. Developers who installed the extension during the exposure window should check for the 'svc-telemetry' SSH key, isolate affected machines, remove unauthorized SSH keys and persistence mechanisms, rotate credentials and sessions, and consider rebuilding environments from safe backups3

3

.

Jenn Gile, co-founder of OpenSourceMalware, warned: "It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware"2

2

. Watch for increased scrutiny of AI-powered development tools and potential changes to extension marketplace security protocols across platforms as the industry responds to this emerging threat vector.