Backdoored Claude Code Extension Slips Through Cursor Marketplace
Phorion reported a backdoored Claude Code extension on Cursor's marketplace that planted SSH keys and persistence, though a macOS permission bug may have blocked inbound access.
Phorion reported a backdoored build of the Claude Code for VS Code extension on Cursor's marketplace that appends an attacker-controlled SSH key, opens a reverse tunnel, and installs persistence across macOS, Linux, and Windows. Cursor removed versions 2.1.312 and 2.1.313.
The injected code runs when Node loads extension.js, before the extension's activate callback, so no user interaction is needed. On macOS, the payload checks Remote Login with systemsetup -getremotelogin without elevation; a standard user gets an administrator-access error that exits 0, so the script skips enabling SSH.
The SSH key and LaunchAgent persistence still land, and the reverse tunnel can connect out, but forwarded traffic hits a closed local port 22 unless Remote Login was already on.
Key takeaways
- The injected IIFE appends an Ed25519 public key with comment svc-telemetry to ~/.ssh/authorized_keys, sets 0700 on ~/.ssh and 0600 on the file, and checks for the comment rather than the key fingerprint.
- The reverse tunnel connects to 134.209.82[.]225 as user tunnel on port 22 using an embedded private key, writes that key to a temp file named .stk_<10 hex chars>, and uses -R *:0:localhost:22 with a detached 60-second retry loop.
- Persistence differs by platform: macOS writes ~/Library/LaunchAgents/com.apple.sysmond.plist to run /bin/sh ~/.config/.smt with RunAtLoad and KeepAlive; Linux adds an @reboot crontab entry; Windows tries a SYSTEM scheduled task or Startup folder script.
- The beacon posts hostname, username, OS, architecture, home directory, Git email, public IP, setup status flags, and up to 40 environment variable names matching KEY|TOKEN|SECRET|PASS|AWS|GCP to /beacon on 134.209.82[.]225:8099 and 127.0.0.1:8099.
- Detection guidance focuses on file modification telemetry for IDE helper processes writing ~/.ssh/authorized_keys, non-Apple processes creating com.apple.* LaunchAgents, and ssh or autossh using -R :0:localhost:22 with identity files from /tmp/.stk_ or ~/.config/.smtk.
What people think
Analysis details
34 comments analyzed. Analyzed .
The sample selects active discussion branches and includes available parent comments. It may omit parts of the full thread. The analysis included 34 of 87 usable stored comments because of the input limit. Selected themes do not measure community opinion or how common a view is.
Anthropic says Cursor marketplace was the vector
Anthropic said the tampered extension was published through Cursor's marketplace, not Anthropic systems or employee devices, and that official VS Code and OpenVSX versions were unaffected. The claim narrows the incident to Cursor users but leaves open how a malicious actor obtained marketplace publishing access.
Reported version removals challenge the narrow scope
Version 2.1.313 was reportedly removed from OpenVSX, the Visual Studio Marketplace, and npm, in addition to Cursor's marketplace. That could be precautionary cleanup or evidence of wider distribution; the supplied evidence does not settle it, but the discrepancy challenges the narrow-scope account.
Extensions inherit full IDE and user access
Because extensions run with the permissions of the IDE and the user, a backdoored bundle gets immediate access to local files, source code, and developer tooling. One argument holds that Claude Code should not have full home-directory access; running LLMs under a dedicated user account or in a container is suggested to limit the blast radius.
Marketplace vetting and signing gaps
Cursor's marketplace is described as a proxy in front of OpenVSX; whether it is a public registry is disputed, and it apparently lacks signing that ties an extension to its claimed publisher. The 'Made by Anthropic' label did not guarantee Anthropic-signed code, prompting calls for publisher signing or removal of the branding.
Branding creates responsibility beyond systems
Even if Anthropic's systems were not breached, the extension carried Anthropic's name and branding, which some argue makes the incident partly Anthropic's problem. The argument calls for technical controls such as Anthropic-controlled signing keys or for Anthropic to stop third-party marketplaces from using its branding.
Cursor's value proposition under scrutiny
Some question whether Cursor's VS Code fork adds enough value to justify supply-chain risk, citing its rapid valuation; others note that SolarWinds, Superfish, and CrowdStrike survived similar scrutiny. The tradeoff weighs economic benefit against the cost of marketplace trust failures.