Cursor Extension Store malware attack affects up to 5,000 users

Dynamic Watch Beating AI News: Cursor disclosed that on October 29, a maliciously tampered version of Claude Code 2.1.313 appeared on its extension marketplace. This installer was not created by Anthropic and remained listed for approximately 11 hours. Cursor estimates up to 5,000 users may have been affected and will contact them directly. Analysis by the security research firm OpenSourceMalware revealed that attackers inserted 66 lines of malicious code before the plugin’s legitimate code. The malicious code executes as soon as the editor loads the extension, even without any user interaction with Claude. The malware collects system information such as the computer name, Git email, and public IP address, and silently adds the attacker’s SSH public key to the authorized keys list. It then attempts to enable remote login, establishes a reverse SSH tunnel to the attacker’s server, and sets up a background task to run at startup, retrying connection every ~60 seconds. However, the attack code contains flaws. Cursor noted that most Mac and Windows systems did not grant it the administrative privileges required to enable the SSH service, preventing attackers from typically establishing tunnel access. Nevertheless, the addition of malicious keys, installation of background scripts, and transmission of device information may still succeed. Systems that already have SSH enabled cannot be assumed safe. Cursor has removed the malicious version, temporarily shut down its entire extension marketplace, and assisted in taking down the attacker’s servers. Affected users must check their SSH authorized_keys file for the entry `svc-telemetry` and use the official cleanup script to remove all traces. Simply uninstalling the extension is insufficient—the backdoor may continue running in the background.