Backdoored Claude Code extension reached up to 5,000 users

A malicious version of Anthropic’s Claude Code extension for VS Code, version 2.1.313, was distributed through Anthropic’s official account on Cursor’s marketplace. Cursor said it could have reached up to 5,000 users before Anthropic replaced it with version 2.1.314. Independent researcher Kevin Beaumont said the safe update appeared several hours after the compromised version was published.

Cursor and security firm Phorian described the incident as a supply-chain compromise; neither Anthropic nor Cursor has explained how the attackers gained control of the account.

Cursor said the extension collected device and user details, including environment-variable names, working directories and public IP addresses, and attempted to install a persistent SSH backdoor and open a reverse tunnel. It was designed to run on Windows, macOS and Linux. Phorian said the environment-variable names could help attackers identify devices holding cloud credentials and API tokens. Coding errors prevented the backdoor from working in some cases, but Phorian said it still posed a significant threat.

Cursor worked with the server’s cloud provider to block connections, removed the package and temporarily shut its marketplace to rotate keys and audit access controls. The marketplace has since reopened.

Cursor said people who installed or updated the extension from its marketplace between 5:27 am and 4:35 pm ET on Thursday should consider themselves affected. The source also advises treating more recent installations as potentially infected. Cursor and Phorian published indicators of compromise. Anthropic had not publicly notified customers at the time of the report.