Overview
- A malicious actor published altered versions of Anthropic’s Claude Code extension to Cursor’s VS Code Extension Marketplace on October 29, and the tampered packages were live for about 11 hours.
- The injected loader collected host data, added an attacker-controlled SSH key, tried to enable SSH and open a reverse SSH tunnel, and wrote platform-specific startup files to keep code running after uninstall.
- Cursor removed the malicious versions, suspended and rebuilt its marketplace, rotated keys, and worked with the cloud host to take the attacker server offline while Anthropic pushed a clean release.
- Cursor says up to roughly 5,000 installs may have occurred during the window but that enabling SSH usually failed without admin rights on most macOS and Windows systems, though planted keys and persistence can still remain.
- Organizations are advised to run Cursor’s detection scripts, isolate suspect machines, remove unauthorized SSH keys and startup scripts, rotate credentials from clean devices, and tighten update governance for developer tools.