Malicious version of the Anthropic Claude Code extension implants an SSH backdoor, affecting the computers of up to 5000 developers

Security firm Phorion discovered that a tampered version 2.1.313 of the Anthropic Claude Code extension was distributed on Open VSX and implanted an SSH backdoor; Cursor estimates that up to 5000 users may be affected. This version was listed on the Cursor extension marketplace on October 29 for about 11 hours, executed malicious code on load without user interaction, added the attacker's SSH key to the authorized list and established an outbound tunnel, returning the hostname, Git email and the names of up to 40 environment variables suspected to be credentials; uninstalling the extension also could not remove the backdoor. Phorion pointed out that the check in the script for activating SSH was flawed, and Cursor said that because activating SSH requires administrator privileges, the attacker could not log in through the tunnel on most Mac and Windows hosts.