Fake Claude extension exposed up to 5,000 users to SSH backdoor
A fake version disguised as Anthropic's official 'Claude Code' coding assistant extension was distributed on the extension marketplace of AI coding tool Cursor for about 11 hours. It planted an SSH backdoor—a hidden remote access route—on the PCs of users who installed it. Cursor said up to 5,000 users installed it between approximately 2:27 a.m. and 1:35 p.m. Pacific time on October 29 (local time). Cursor confirmed the extension was not created by Anthropic.
The timeline was pieced together from an analysis by security firm StepSecurity. The legitimate version 2.1.312 was posted to Open VSX at 20:26 UTC on October 27. A tampered version identifying itself as anthropic.claude-code version 2.1.313 appeared at around 09:27 UTC on October 29, and at 20:35 UTC the same day Cursor took it down and took the entire marketplace offline. The legitimate version 2.1.314 was posted at 01:07 UTC on October 30.
Analysis of the attack code has also been made public. Jen Gil, co-founder of OpenSourceMalware, explained that a 66-line malicious loader—a program that fetches and executes other code—was inserted into the main JavaScript bundle ahead of the legitimate extension code. According to StepSecurity, the malicious file was about 7KB larger than the immediately preceding legitimate version, at 3,692,922 bytes.
Some details remain unverified. Anthropic's official position could not be found on its news page, status page, or the Claude Code GitHub security advisories. The Claude Code changelog jumps from 2.1.312 to 2.1.314, with no entry for 2.1.313. The perpetrator of the attack is also unknown.
Cursor shut down the marketplace, rotated its keys, and rebuilt it to restore service. The company said that after auditing access logs, it found no other tampered extensions and no evidence that other versions or official distributions were affected. The attacker's server was taken offline in cooperation with the hosting provider, and Anthropic published the legitimate version 2.1.314 on Open VSX and the Microsoft VS Code Marketplace.
