Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Original Article ↗ Hacker News Discussion ↗

A maliciously modified version of the popular Claude Code extension for VS Code was briefly distributed via Cursor’s extension marketplace, adding an attacker-controlled SSH key and creating a remote access backdoor on affected developer machines. Commenters debate whether this represents a compromise of Anthropic itself or of Cursor’s marketplace infrastructure and highlight broader weaknesses in the VS Code/OpenVSX extension ecosystem, including lack of signing, marketplace impersonation, and over-privileged editor plugins. The incident is seen as a high‑stakes supply‑chain warning, especially given possible links to a major crypto theft, and has prompted calls for stronger isolation of development tools, delayed auto‑updates, and more rigorous provenance checks for extensions.

Incident Overview

  • A malicious build of the “Claude Code for VS Code” extension, version 2.1.313, shipped with an SSH-based backdoor (reverse shell).
  • Payload behavior (per linked analyses): ensures ~/.ssh exists, appends an attacker key labeled svc-telemetry to authorized_keys, sets strict permissions, and establishes a reverse tunnel.
  • Blast radius is unclear: Cursor later reported about 5,000 affected users on their side; the extension brand overall has tens of millions of installs across ecosystems.

Where the Malicious Version Lived

  • Thread participants distinguish three ecosystems:
    • Microsoft VS Code Marketplace.
    • Open VSX (used by VS Code forks / non-Microsoft builds).
    • Cursor’s own marketplace / proxy in front of Open VSX.
  • Multiple comments, including from Anthropic representatives, say:
    • The malicious 2.1.313 was only on Cursor’s marketplace.
    • It was not shipped via the official VS Code marketplace or Open VSX.
    • 2.1.313 was never an official Anthropic release; 2.1.314 was used to “skip over” that version globally and avoid confusion.
  • Earlier comments suspected Open VSX compromise; later clarifications say this specific incident was confined to Cursor’s proxy/marketplace.

Responsibility and Root Cause (Unclear / Disputed)

  • One side: this is a Cursor marketplace compromise (or impersonation), not an Anthropic system or laptop breach.
  • Others argue Anthropic still bears some responsibility because:
    • Cursor’s listing used Anthropic branding (“made by” semantics).
    • Users reasonably assumed Anthropic controlled that extension channel.
  • Exact mechanism of the attacker’s access to Cursor’s marketplace is not yet known.

Impact, Detection, and Mitigation

  • Cursor’s advisory: users can check for an added svc-telemetry SSH key in authorized_keys to see if they were impacted.
  • Some note that absence of that key suggests the payload did not fully execute.
  • Concerns raised that even if the goal was crypto theft, the reverse shell also exposed source code, secrets, and infrastructure.

Links to Other Incidents (Unproven)

  • Several comments speculate about a connection to a contemporaneous major crypto-theft incident, noting timing and that the victim publicly uses Cursor + Claude Code.
  • Others caution this is circumstantial and not confirmed.

Ecosystem & Supply-Chain Concerns

  • VS Code / VSCodium / Open VSX ecosystems are criticized as:
    • Lacking strong signing, verification, and permission models for extensions.
    • Vulnerable to typosquatting and marketplace impersonation.
  • Cursor’s claim of automated malware/supply-chain scanning is questioned given the ~11-hour window where the malicious build was live.
  • Discussion broadens to:
    • Package registries (npm, etc.) as similar weak links.
    • Need for extension signing, trusted-publishing workflows, and delayed auto-updates (VS Code and Cursor both have delay features, but defaults may be too aggressive).

AI Tools, Trust, and Isolation

  • Many commenters reassess the risk of:
    • Agentic IDE tools with RCE-like capabilities.
    • CLI utilities and harnesses that run arbitrary code on developer machines.
  • Recommended mitigations:
    • Run AI tools in containers, VMs, or separate user accounts with minimal mounted directories and tightly scoped SSH/Cloud credentials.
    • Disable or delay auto-updates; manually vet new versions when feasible.

Communication and Trust

  • Several participants find public communication confusing and slow, especially around:
    • Which marketplaces were impacted.
    • Whether Anthropic’s own systems were compromised.
  • Calls for clearer, centralized incident reports and postmortems from both Anthropic and Cursor, beyond scattered social posts and marketplace edits.