Code editor developer Cursor has issued a security advisory urging users who installed specific versions of the Claude Code extension to perform comprehensive host cleanup and credential rotation. The company identified malicious packages, specifically Anthropic.claude-code versions 2.1.312 and 2.1.313 for macOS and Windows, which were briefly available on its marketplace. According to Cursor, these rogue versions were not developed by Anthropic, and there is no evidence that other versions or the official distribution channels were compromised. The incident highlights a significant supply chain risk for developers relying on third-party extension marketplaces.

Persistent access mechanisms

Security researcher Phorion, who updated its malware analysis on October 31, detailed how the payload operates. The malicious code executes when Node loads the extension module, prior to its normal activation callback. Its primary objective is to establish persistent remote access by adding an attacker-controlled SSH key, enabling the host's SSH remote-login service, and creating a reverse tunnel. Phorion noted that persistence is achieved through a macOS LaunchAgent and, on Windows, a scheduled task with a Startup-folder fallback. Consequently, simply uninstalling the extension may leave these components active, allowing attackers to maintain access if the SSH service remains enabled.

Limited data collection and scope

The initial beacon sent by the malware reported host information and up to 40 matching environment-variable names, but not their secret values. While this suggests limited initial data exfiltration, Cursor cautions that this does not rule out later credential access through the established backdoor. The successful execution of remote access also depended on specific host configurations. Phorion found that a permission-check bug caused the macOS code to skip enabling Remote Login when run as a standard user, though the planted key could still permit access if SSH was already enabled or enabled later. Neither the Cursor advisory nor Phorion's analysis has established cryptocurrency theft or crypto-specific targeting.

Remediation and next steps

Cursor stated it worked with its hosting provider to take the attacker's server offline, removed the malicious packages, rotated its own keys, and rebuilt the marketplace. However, these actions do not remove components already installed on user machines. The company recommends that affected users check endpoint, network, and extension-installation records to identify compromised hosts. Users should isolate affected machines, remove unauthorized SSH keys, persistence mechanisms, and running tunnels, and assess whether the host requires a full rebuild. Crucially, Cursor advises rotating all credentials and sessions accessible from affected hosts using a trusted system. For crypto developers, this extends to any development or financial-service credentials accessible to the local user account.