A malicious version of the Claude Code extension appeared on the Cursor VS Code Extension Marketplace for roughly 11 hours on October 29, 2026. The incident shows how a package that looks and works normally can still become an entry point into developer workstations when malicious code is inserted into its distribution chain.
What happened?
According to Cursor's official notice, maliciously modified Windows and macOS builds of Anthropic.claude-code 2.1.312 and 2.1.313 were distributed through Cursor's marketplace from about 2:27 a.m. to 1:35 p.m. Pacific Time on October 29. Cursor stressed that Anthropic did not develop the malware, and there is no evidence that official releases on Microsoft's Visual Studio Code Marketplace, Open VSX, or the Claude Code npm package were affected.
Cursor removed the malicious versions, temporarily shut down the marketplace for an audit, rotated access keys, and rebuilt the service. It also worked with the infrastructure provider to take the attacker's server offline.
Why could the extension run malware as soon as it loaded?
Phân tích của Phorion và OpenSourceMalware cho thấy một đoạn JavaScript ngắn được chèn ở đầu tệp extension.js, trước phần mã hợp lệ. Đoạn mã này chạy khi trình chủ nạp tiện ích, không cần người dùng mở cuộc trò chuyện với Claude Code hay thực hiện thao tác đặc biệt.
This is the central risk of IDE extensions: they run with the editor user's permissions and can access source code, configuration files, SSH stores, and environment variables. Familiar branding and a normal interface are not sufficient proof that an installation artifact is safe.
How did the attack chain work?
Once loaded, the malware collected the hostname, username, operating system, CPU architecture, working directory, Git email, and names of selected environment variables associated with keys, tokens, or passwords. Secret values were not included directly in the initial beacon, but variable names could help attackers identify valuable hosts.
Mã độc tiếp tục thêm khóa công khai Ed25519 có nhãn svc-telemetry vào tệp authorized_keys, thử bật dịch vụ SSH và tạo đường hầm SSH ngược tới máy chủ điều khiển. Cơ chế duy trì hiện diện được cài bằng LaunchAgent trên macOS, tác vụ theo lịch hoặc thư mục Startup trên Windows; phân tích mẫu còn ghi nhận nhánh cron cho Linux.
Why do coding errors not make affected systems safe?
Some SSH-enablement steps were faulty. On macOS, checking Remote Login required administrative access, causing the malware to misread the state; on Windows, one branch tried to invoke PowerShell through a Unix-style shell path. Remote access may therefore have failed on many systems where SSH was not already enabled.
However, the unauthorized key could still be written, persistence could still be installed, and reconnaissance could still be transmitted. If SSH was active or the editor had elevated privileges, interactive access remained possible. Taking the command server offline also cannot rule out data transmission or access that occurred earlier.
Who should check immediately?
The highest priority is anyone who installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor's marketplace on Windows or macOS during the disclosed window. Organizations should query software inventory, extension installation logs, and EDR telemetry rather than relying only on user recollection, because automatic updates may go unnoticed.
Dấu hiệu nổi bật gồm chuỗi svc-telemetry trong tệp SSH authorized keys, tệp ẩn ~/.config/.smt and .smtk, LaunchAgent com.apple.sysmond.plist, tác vụ Windows SysMon, cùng kết nối tới địa chỉ 134.209.82[.]225 trên cổng 22 hoặc 8099. Các tên này phải được đánh giá trong ngữ cảnh vì một chỉ báo đơn lẻ chưa luôn đủ để kết luận.
A safe incident-response process
If indicators are found, isolate the host, preserve evidence, and determine whether the payload merely executed or an SSH login occurred. Then remove the extension, unauthorized SSH key, tunnel processes, and persistence. Uninstalling the extension alone is insufficient because standalone files may continue running.
Passwords, API tokens, cloud keys, sessions, and repository credentials accessible to the affected account should be revoked or rotated from a clean device. If interactive access is evident, rebuilding from a trusted image and reviewing downstream activity in repositories, CI/CD, and cloud services is safer.
Lessons for IDE extension management
Doanh nghiệp nên lập danh mục tiện ích được phép, ghim phiên bản khi cần, lưu lịch sử cài đặt và giám sát thay đổi ở authorized_keys, LaunchAgents, scheduled tasks cùng lưu lượng SSH bất thường. Marketplace là một lớp phân phối thuận tiện, không phải ranh giới tin cậy tuyệt đối.
Development teams should also separate privileged accounts from daily coding, minimize long-lived secrets in environment variables, and use short-lived tokens. These controls reduce damage even when a legitimate extension is briefly replaced.
Conclusion
The Cursor Claude Code incident is a clear example of a software-supply-chain attack targeting developer tooling. The response must go beyond removing versions 2.1.312 and 2.1.313: teams should hunt for artifacts, revoke credentials, and validate the entire workstation. Evidence-based response avoids both dismissing flawed malware and incorrectly extending the incident to unaffected distribution channels.
VNCyberS compiled from Cursor, BleepingComputer, Phorion, and OpenSourceMalware
Tiếng Việt
English