Modified extension installs SSH backdoor

A modified version of the "Claude Code" extension by Anthropic was alleged to have installed an SSH backdoor on developers' machines, according to the security company Phorion. The version 2.1.313 appeared on Open VSX, a platform used by editors like Cursor and Windsurf, and was available in the Cursor store for about 11 hours on October 29.

Estimated number of affected users

Cursor estimates that up to 5,000 users may have been affected by the malicious extension. The backdoor adds the attacker's SSH key to the user's authorized keys and opens a tunnel to the attacker's server to retrieve data such as the victim's working directory, Git email address, and up to 40 environment variables.

Uninstalling the extension does not remove the backdoor

Uninstalling the extension is not sufficient to remove the backdoor. The malware deploys autonomous scripts that continue to execute, and users are advised to check their SSH authorized keys file for an entry titled svc-telemetry. Both Phorion and Cursor provided commands and cleaning scripts for macOS and Windows.

Phorion identifies the malicious package

Researchers from Phorion, a macOS security company, discovered the malicious package, version 2.1.313, on Open VSX, an open-source extension store for VS Code managed by the Eclipse Foundation. The default extension store for VS Code is Microsoft's Visual Studio Marketplace, where no malicious versions have been reported.

Malicious code injection method

The compromised extension.js file begins with an injected and immediately invoked function expression (IIFE) placed at the head of the minified extension bundle. This IIFE imports standard Node.js modules and executes as soon as Node loads the file, before the normal extension activation callback function is executed.

Backdoor's persistent connection

Once executed, the code adds the attacker's SSH key to the user's authorized keys file, allowing the attacker to log in as that user. It then opens an outgoing SSH connection to the attacker's server, creating a tunnel that the operator can use to reconnect to the victim's machine. The malware attempts to reestablish the connection approximately every 60 seconds.

Data sent to attacker's server

The extension sends the machine's hostname, the user name, the operating system, the personal directory, the working directory, the Git email address, and the public IP address to the attacker's server. It also sends the names of up to 40 environment variables that resemble keys, tokens, passwords, or cloud identifiers.

Limitation under macOS

A flaw limits the damage under macOS. The implanted key only works if the machine's SSH service is active, and under macOS, the step to activate it is often never executed. However, the backdoor remains a significant threat if the SSH service is activated later.

Cursor responds to the incident

In a security advisory, Cursor stated that the malicious version had been available on its VS Code extension store for about 11 hours on October 29. The company plans to contact affected users directly and confirmed that the malicious version was not developed by Anthropic. It also noted that the extension did not have administrator rights on most Mac and Windows hosts.

Actions taken by Cursor

After removing the malicious version, Cursor closed its VS Code store as a precaution, conducted an access audit, and found no other modified extensions. The company then renewed its keys and rebuilt the store, reactivating it after ensuring there was no further risk.

AI threat concerns

This incident adds to a series of signals that lead some experts to judge that the AI threat is now out of control. These specialists base their views on recent developments such as models capable of self-improvement, AI agents that have evaded human monitoring, and AI-generated misinformation used by the U.S. military. Despite legislative proposals, some fear it may already be too late to halt the AI threat.