The short version
- A malicious version of the Claude Code VS Code extension, specifically version 2.1.313, was distributed through the Cursor Marketplace.
- The trojanized software installed a persistent SSH backdoor on infected developer machines, granting attackers remote access.
- Cursor disclosed the security incident, highlighting vulnerabilities in the software supply chain for AI-assisted development tools.
A significant security breach involving the Claude Code extension for Visual Studio Code has been identified by cybersecurity researchers. The compromised software, distributed through the Cursor Marketplace, contained malicious code designed to install a persistent SSH backdoor on the machines of developers who installed it. This incident underscores growing concerns regarding the integrity of third-party extensions in popular development environments.
The specific version implicated in the attack is 2.1.313. According to reports from Rescana and Step Security, this trojanized extension was not merely a benign tool with bugs but was actively weaponized. Once installed, the extension executed code that established an SSH backdoor. This type of access allows attackers to remotely control the infected machine, potentially exfiltrating sensitive source code, credentials, or other proprietary data stored on the developer's workstation.
The persistence mechanism embedded in the backdoor is particularly concerning for enterprise security. Unlike transient malware that might be cleared by a reboot, persistent backdoors remain active across system restarts, ensuring long-term unauthorized access. Step Security noted that the delivery method targeted developer machines directly, which often contain high-value intellectual property and access keys to cloud infrastructure.
Cursor, the platform hosting the marketplace where the extension was available, disclosed the attempt in a statement reported by Unite.AI. The disclosure indicates that the malicious activity was detected before it could potentially spread more widely or cause broader damage across the user base. However, the presence of such a sophisticated attack vector in a marketplace for development tools raises questions about vetting processes for extensions.
The Hacker News and Help Net Security both covered the incident, emphasizing the severity of poisoning official-looking extensions. The term 'poisoned' refers to the practice of inserting malicious code into legitimate software packages. In this case, the Claude Code extension, a tool used by developers to integrate AI assistance into their coding workflow, was subverted to serve as an entry point for cybercriminals.
This event highlights the risks associated with the expanding ecosystem of AI-powered coding assistants. As developers increasingly rely on these tools to boost productivity, the attack surface expands. Extensions often require elevated permissions to function effectively within IDEs like VS Code, making them attractive targets for attackers seeking deep system access.
Security experts advise developers to verify the integrity of their extensions and monitor for unusual network activity that might indicate an SSH connection initiated by unknown processes. The incident serves as a reminder that supply chain security is critical not just for large software vendors but also for the smaller, specialized tools that developers integrate into their daily workflows.
While the immediate threat appears to have been contained through disclosure and removal of the malicious package, the long-term implications for trust in extension marketplaces remain. Developers must remain vigilant, and platforms like Cursor may need to implement stricter verification protocols to prevent similar compromises in the future. The incident has sparked discussion on Hacker News regarding the broader state of software supply chain security.
No specific attribution for the attack has been confirmed in the available reporting. The focus remains on the technical details of the compromise and the steps taken to mitigate the risk. Users who had installed version 2.1.313 are urged to remove the extension immediately and scan their systems for signs of unauthorized access.
The incident marks a notable escalation in threats targeting developer infrastructure. As AI tools become more central to software creation, ensuring their security is paramount. The breach demonstrates that even widely used and seemingly reputable extensions can be compromised, necessitating ongoing vigilance from both users and platform providers.
Sources behind this briefing
Go to the original reporting
- The Hacker News↗Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
- Step Security↗Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines
- Rescana↗Trojanized Claude Code Extension 2.1.313 in Cursor Marketplace Plants SSH Backdoor
- Unite.AI↗Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension
