Backdoored Anthropic VS Code extension on Cursor may have affected up to 5,000 developers

An official Anthropic VS Code extension distributed through Cursor was backdoored for nearly 12 hours and may have affected as many as 5,000 developers, multiple sources reported Friday. Anthropic has not yet warned customers of the incident, while Cursor removed the malicious version and took steps to block further distribution. Developers who installed or updated the extension during the affected window should consider themselves potentially compromised.

What happened

The compromised package was a VS Code extension available in Cursor's marketplace. The malicious version, 2.1.313, was posted to Anthropic's official account on Cursor and superseded version 2.1.312, according to Phorian CTO and co-founder Luke Roberts. Anthropic pushed version 2.1.314 several hours after the previous version became available, according to independent researcher Kevin Beaumont. Extensions auto-update in Cursor by default, though users can configure this in settings.

What the backdoor could do

Cursor said the malicious extension attempts to install a persistent SSH backdoor using an added attacker-controlled SSH key, enable the local SSH service, and open a reverse SSH tunnel. The code was written to work on Windows, macOS, and Linux. Because Cursor extensions run with the permissions of the tool's Integrated Development Environment, the backdoored version likely would gain access to local files, source code, and developer tooling once installed.

Cursor said the backdoor's capabilities include collecting host and user information, attempting to add an attacker-controlled SSH key to authorized_keys, enabling the local SSH service, opening a reverse SSH tunnel, and reporting host details and backdoor status via HTTP POST to /beacon on port 8099. Phorian said theft of variable names allowed the operator to take inventory of cloud credentials and API tokens stored on a compromised device, likely to prioritize machines for follow-up attacks. Bugs in the malicious code for Windows and macOS prevented the backdoor from working in some cases.

Response and impact

Cursor said company personnel worked with the cloud provider hosting the server the reverse shell connected to so infected devices could no longer reach it. Personnel also removed the backdoored version from the marketplace and blocked further distribution. The company also shut down the VSCode Marketplace to rotate keys, audit access controls, and confirm no other extensions were compromised. The marketplace is now open.

Anyone who installed or updated Anthropic's VS Code extension from Cursor between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected. It may be wise for anyone who has recently done so to also consider themselves potentially infected. Both Cursor and Phorian list indicators of compromise, including IP addresses and cryptographic hashes. It remains unclear why Anthropic is not publicly warning customers and why neither company has explained how the supply-chain compromise happened.

Sources: Ars Technica