Malicious Claude Code Plugin Appears in Cursor's Official Marketplace, Affecting About 5,000 Developers Over Roughly 11 Hours
Cursor's plugin marketplace listed a tampered Anthropic Claude Code extension on October 29, version number 2.1.313, for about 11 hours, with as many as 5,000 developers potentially downloading it. Cursor has confirmed that the malware attempted to install a persistent SSH backdoor, collected usernames, hostnames, public IP addresses, Git email addresses, and the names of environment variables related to sensitive credentials and sent them to the attacker's server, and also added an attacker-controlled SSH key to achieve persistence. Cursor has removed the extension and temporarily shut down the entire extension marketplace to review other plugins and rotate access keys, while coordinating with the hosting provider to shut down the attacker's server, but it has not yet explained how the attacker published the tampered software package under Anthropic's name.
Why read this
AI score 69
The incident disclosed the timeline of the malicious plugin from listing to takedown, its scope of impact, and its persistence techniques, allowing developers to assess plugin supply chain risks.
Topics
Body · AI translation
11 hours affected about 5,000 developers: Malicious Claude Code plugin appears in the official marketplace of AI programming tool Cursor
English text is being prepared.
English text is being prepared.
English text is being prepared.
English text is being prepared.
The report pointed out that the malicious Claude Code version was numbered 2.1.313 and was distributed for about 11 hours between 2:27 a.m. and 1:35 p.m. Pacific Time (17:27 Beijing Time on October 29 to 4:35 a.m. on October 30), and as many as 5,000 developers may have downloaded it.
Cursor has confirmed that the malware attempted to install a persistent SSH backdoor on users' devices. Security researchers found that the attacker did not modify the original legitimate functional code, but only inserted a malicious JavaScript loader at the beginning of the extension's extension.js file.
After developers install the malicious version of Claude Code, the malicious code runs automatically without any interaction with Claude Code. The malicious program collects usernames, hostnames, public IPs, Git emails, and the names of environment variables related to sensitive credentials, and sends the information to the attacker's server.
It also adds SSH keys controlled by the attacker, attempts to enable SSH access, establishes a reverse tunnel, and achieves persistence through macOS LaunchAgent or Windows scheduled tasks and startup scripts, retrying the connection about once per minute.
However, because the malicious code has obvious errors in the SSH configuration step, many Windows and macOS devices may not have had remote access successfully enabled. For example, on macOS it did not execute the check command with administrator privileges; on Windows it incorrectly invoked the Unix shell /bin/ sh.
Cursor has taken down the malicious extension and temporarily closed the entire extension marketplace to review other plugins and rotate access keys. The company also worked with the hosting provider to shut down the attacker's server, cutting off the reverse SSH connection and data exfiltration.
Cursor stated that no other extension versions or official distribution channels were found to be affected, but it has not yet explained how the attacker published the tampered software package in the name of Anthropic.