Supply Chain Attack: Malicious Claude Code Extension Compromises Developer Systems
Incident Overview
A supply chain attack recently compromised the Claude Code extension for VS Code, leading to the distribution of a remote access trojan (RAT) to approximately 5,000 developer systems. The malicious version, identified as 2.1.313, was distributed through the Cursor marketplace under Anthropic’s verified account. The compromised extension was subsequently removed and replaced with version 2.1.314, which appears to remediate the immediate threat but does not automatically remove backdoors from already infected machines.
Technical Impact and Backdoor Mechanism
The malicious extension was designed to establish persistent remote access to developer environments. According to incident reports, the malware performed the following actions:
- Data Exfiltration: Collected sensitive host information, including usernames, hostnames, OS architecture, home directory paths, environment variables, Git configurations, and public IP addresses.
- Persistence: Attempted to add an attacker-controlled SSH key to the
authorized_keysfile and enable local SSH services. It further attempted to establish persistence via macOS LaunchAgents or Windows scheduled tasks and startup scripts. - Command and Control (C2): The malware attempted to initiate a reverse SSH tunnel to an attacker-controlled IP (134.209.82.225) and communicated status updates via HTTP POST requests to a
/beaconendpoint on port 8099.
While the malicious code attempted to gain high-level system access, researchers noted that the installation of the SSH backdoor would typically fail unless the Cursor application was running with administrator privileges.
Scope and Remediation
The attack specifically targeted users of the Cursor IDE and its extension marketplace. Users of the official Microsoft Visual Studio Marketplace or standard VS Code extensions are generally considered outside the scope of this specific incident, though developers are encouraged to audit their systems for the indicators of compromise (IoCs) provided by security researchers.
Security analysts have provided KQL queries for Microsoft Defender for Endpoint to assist in identifying impacted systems. Because the malicious version was removed and replaced, simply updating the extension is insufficient for systems that were already compromised. Affected users must manually remove the unauthorized SSH keys and terminate any established reverse tunnels or malicious scheduled tasks.
Community Response
Discussion within the developer community has highlighted concerns regarding the security of third-party extension marketplaces and the risks of granting IDE extensions broad system permissions. Some observers noted the discrepancy between the severity of the incident and the initial communication, with Cursor clarifying that the malicious version was not developed by Anthropic, but rather injected into their marketplace under the vendor's identity.
"A maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace. The extension runs malicious code that attempts to install a persistent SSH backdoor." — Cursor Security Notice
Security researchers emphasize that while the immediate threat has been mitigated by the removal of the malicious VSIX package, the incident serves as a reminder of the risks inherent in automated supply chains and the necessity of monitoring endpoint activity for unexpected network beacons.