Trojanized Claude Code Extension Delivered SSH Backdoor via Cursor Marketplace

A supply chain compromise placed a backdoored version of Anthropic's Claude Code extension in Cursor's marketplace for roughly 11-12 hours, reaching up to 5,000 users before removal. The malicious versions added SSH keys, installed persistence mechanisms, and exfiltrated host data—but the compromise occurred on Cursor's distribution channel, not Anthropic's systems, and only affects users who installed through Cursor's marketplace.

• Malicious versions 2.1.312 and 2.1.313 were distributed through the Cursor Marketplace under Anthropic's legitimate extension ID (anthropic.claude-code) on October 29, remaining available for approximately 11-12 hours before removal.
• The backdoor added an SSH authorized key, attempted to establish a reverse SSH tunnel, installed persistence across macOS, Linux, and Windows, and collected hostname, username, OS, and public IP address.
• Cursor reports at most 5,000 users were affected; the company took its entire marketplace offline during remediation and confirmed no other extensions were compromised.
• Anthropic states the tampered extension was not built or published by them, and versions on official channels remain unaffected—only Cursor marketplace users are impacted.
• Neither Cursor nor Anthropic has explained how attackers gained access to publish under Anthropic's verified Cursor account.

Bottom line If you installed Claude Code through Cursor's marketplace, immediately check for versions 2.1.312 or 2.1.313, review for unauthorized SSH keys and persistence mechanisms, and engage incident response.