A Tampered Claude Code Plugin Sat in Cursor’s Store for 11 Hours

October 31 — The tech outlet bleepingcomputer reported yesterday (30 October) that the AI coding tool Cursor’s plugin marketplace carried a tampered Anthropic Claude Code extension on 29 October for about 11 hours, affecting roughly 5,000 developers worldwide.

The Cursor Marketplace is the official store for discovering, installing and managing plugins, used to connect Cursor’s AI agent to external tools, data sources and workflows.

The malicious Claude Code build was version 2.1.313, distributed for about 11 hours between 2:27 am and 1:35 pm Pacific time — 17:27 Beijing time on 29 October to 04:35 on 30 October — and may have been downloaded by as many as 5,000 developers.

Cursor has confirmed that the malware tried to install a persistent SSH backdoor on users’ devices. Security researchers found the attackers did not alter the legitimate feature code; they simply inserted a malicious JavaScript loader at the start of the extension’s extension.js file.

Once a developer installed the malicious Claude Code build, the malicious code ran automatically without any interaction with Claude Code. It collected usernames, hostnames, public IP addresses, Git email addresses and the names of environment variables tied to sensitive credentials, and sent them to an attacker-controlled server.

It also added an SSH key controlled by the attackers, tried to enable SSH access, established a reverse tunnel and achieved persistence through a macOS LaunchAgent or a Windows scheduled task or startup script, retrying the connection roughly once a minute.

However, because the malicious code contained obvious errors in its SSH configuration, many Windows and macOS devices may never have had remote access successfully enabled. On macOS, for example, it ran its checks without administrator privileges; on Windows, it wrongly called the Unix shell /bin/sh.

Cursor has removed the malicious extension and temporarily shut the entire marketplace to review other plugins and rotate access keys. It also worked with hosting providers to take down the attackers’ server, cutting the reverse SSH connections and data exfiltration.

Cursor says no other extension versions or official distribution channels appear to be affected, but it has not explained how the attackers managed to publish a tampered package under Anthropic’s name.