Cursor Extension Store Malware Incident Affects Up to 5,000 Users

ME AI News, Dongcha Beating AI Bulletin: Cursor disclosed on October 29 that a maliciously tampered version of Claude Code 2.1.313 appeared on its extension marketplace. This installer was not created by Anthropic and remained listed for approximately 11 hours. Cursor estimates up to 5,000 users may have been affected and will contact them directly. Analysis by the security research firm OpenSourceMalware revealed that the attacker inserted 66 lines of malicious code before the plugin’s legitimate code. The malicious code executes as soon as the editor loads the extension, even without user interaction with Claude. The malware collects system information such as computer name, Git email, and public IP address, and secretly adds the attacker’s SSH key to the authorized keys list. It then attempts to enable remote login, establishes a reverse SSH tunnel to the attacker’s server, and sets up a background task to run at startup, retrying connection every ~60 seconds. However, the attack code contains errors: Cursor noted that most Mac and Windows systems did not grant it the administrative privileges required to enable the SSH service, preventing the attacker from typically establishing a tunnel connection. Nevertheless, the malicious key addition, background script installation, and device data exfiltration may still succeed. Systems that already have SSH enabled cannot be assumed safe. Cursor has removed the malicious version, temporarily shut down its entire extension marketplace, and assisted in taking down the attacker’s servers. Affected users must check their SSH authorized_keys file for the entry `svc-telemetry` and use the official cleanup script to remove all traces. Simply uninstalling the extension is insufficient—the backdoor may continue running. (Source: MLion)