Summary
- Cursor served malicious Claude Code extension versions 2.1.312 and 2.1.313 on 29 October.
- The injected code collected host information and attempted to establish persistent SSH access.
- Cursor and Microsoft say official Anthropic and Microsoft distribution channels were not compromised.
Malicious versions of a coding extension were distributed through Cursor‘s marketplace on 29 October, introducing JavaScript designed to establish persistent SSH access on developers’ computers. The packages impersonated Anthropic’s Claude Code extension and were identified as versions 2.1.312 and 2.1.313.
Cursor said the malicious packages were available from approximately 2:27am to 1:35pm Pacific time. The packages were withdrawn and action was taken against attacker-controlled infrastructure after the problem was identified. Anthropic’s official distribution systems and Microsoft’s Visual Studio Marketplace were not reported to have been compromised.
Microsoft Security Research examined the injected script and found that it executed when the extension loaded. Its first routines gathered operating-system information, hostname, username, working directory, and a Git email address. It also inspected names of environment variables associated with secrets or cloud services; the analysed collection routine reported matching names rather than the underlying secret values.
The next stage attempted to install an attacker-controlled public key in the local SSH configuration, enable the SSH service, and establish a reverse connection to external infrastructure. Startup scripts and additional configuration were intended to preserve that access between sessions, making a successful installation more persistent than a single command executed through the editor.
The attempted sequence depended on local permissions and the configuration of the operating system. Cursor said errors in the malicious code and the need for elevated privileges prevented some steps from succeeding on many Windows and macOS devices. The presence of malicious code therefore cannot be equated with successful remote access on every affected workstation.
Microsoft identified configuration changes that might remain after the extension was removed. Affected users could need to examine SSH keys, service settings, and persistent startup entries as well as the extension version. Removing the download source and disabling the package prevents normal re-execution, but does not necessarily undo a change previously made by privileged code.
Security company Expel investigated four customer cases connected to the malicious packages, including one showing activity after the original distribution interval. The period during which a malicious version was available and the period when already installed copies could operate are not the same, particularly where the extension loads automatically during development sessions.
Editor extensions sit close to valuable developer resources. They can interact with source repositories, local configuration, cloud command-line utilities, and credentials used to build or deploy applications. A foothold in a developer’s machine can consequently create exposure beyond the editor, according to the permissions granted to the process and the accounts available locally.
The incident concerns the trust placed in extension marketplaces as distribution systems. Developers may recognise a familiar product name and assume that the code was supplied by its usual publisher. An alternative marketplace must preserve its own controls for publisher identity and package integrity; the security of one official distribution channel does not guarantee the same protection elsewhere.
A compromise of a developer workstation could also affect software delivery if the device holds privileged repository access or deployment credentials. That is a potential consequence of persistent access, not proof that the observed Cursor incidents resulted in altered source code or malicious software releases.
Reviewing a potentially affected installation involves separating attempted commands from actions that succeeded. An SSH configuration entry, suspicious outbound connection, or unexpected startup service can provide stronger evidence of persistence than the mere presence of a malicious extension file. Endpoint logs and account records are needed to determine whether follow-on access took place.
Cursor and Microsoft documented the affected versions and the behaviour of the injected code. Their findings establish a malicious marketplace delivery and a concrete attempt to build remote access, while successful exploitation remains dependent on the state and permissions of each affected computer.
The distribution route was remediated and attacker infrastructure was disrupted. Individual developers and organisations still need to determine whether installations obtained during the exposure window left changes behind, based on local evidence rather than on assumptions about the malware’s success rate.
