Malicious Cursor Marketplace Extension Backdoors Up to 5,000 Developer Systems
Written by AI from the linked story. Not reviewed by an editor. How this works
A trojanized Claude Code extension (v2.1.313) was distributed through Cursor's marketplace, embedding SSH key injection, reverse tunnel establishment, and persistence mechanisms — classic supply chain attack hallmarks targeting developer tooling. The incident exposes how extension marketplaces can become high-value attack vectors when publisher identity verification and code vetting are insufficient. Developers inherently trust marketplace listings, making malicious packages particularly dangerous as they execute with user-level or elevated permissions. The discrepancy between Cursor's marketplace records and Open VSX/npm registries also highlights a monitoring gap that delayed detection and complicated attribution.
Tactical Insight
Immediate actions
- Audit and remove any installed instances of Claude Code extension v2.1.313 and rotate SSH authorized_keys files on all affected developer machines.
- Scan systems for unauthorized SSH keys, active reverse tunnel processes, and persistence artifacts (cron jobs, systemd units, startup scripts) introduced by the extension.
Long-term improvements
- Require cryptographic signing and automated static analysis of all extensions before marketplace publication, including checks for network calls, file system writes, and shell execution.
- Establish a cross-registry validation process to reconcile package publication records across all distribution channels (npm, Open VSX, proprietary marketplaces) and flag discrepancies automatically.
- Implement least-privilege sandboxing for IDE extensions to restrict their ability to modify SSH configurations or establish outbound tunnels.
Detection measures
- Deploy endpoint monitoring rules to alert on unauthorized modifications to `~/.ssh/authorized_keys` and unexpected outbound SSH connections from developer workstations.
- Maintain a software bill of materials (SBOM) for all installed extensions and tooling, enabling rapid impact assessment when a malicious package is identified.