Cursor 官方插件商城现恶意 Claude Code 扩展，约 11 小时影响最多 5000 名开发者

你从官方插件商城装下一个看起来一切正常的 Claude Code 扩展。

事件回放：官方商城里的 11 小时

太平洋时间 10 月 29 日凌晨 2:27，版本号为 2.1.313 的 Claude Code 扩展出现在 Cursor Marketplace。下午 1:35，它被下架，前后在线约 11 小时。

这不是 Anthropic 发布的包。 Cursor 确认了这一点，并指出最多约 5000 名开发者在这 11 小时内下载并安装了该扩展。

装扩展的时候谁没想过"这是官方商城，应该没问题"

Cursor 随后关闭了商城进行安全审计，逐个联系受影响用户，并推送了 2.1.314 版本要求用户更新。

攻击者的切入点很直接：改了一个文件，在正常代码前插入了 66 行 JavaScript。原有功能代码几乎没动，扩展看起来照常工作。但 Cursor 只要加载这个扩展，那 66 行恶意代码就会执行，不需要用户主动打开 Claude Code。

恶意代码做了什么

安全研究人员拆解了这段 66 行的恶意加载器，它的动作可以归纳为四类。

第一类是信息收集。它获取主机名、用户名、操作系统、架构、home 路径、环境变量名（注意是变量名，不是值）、工作目录、Git 邮箱和公网 IP。这些信息被打包发送到攻击者控制的服务器。

第二类是 SSH 后门植入。恶意代码向 ~/.ssh/authorized_keys 追加一个带有 svc-telemetry 标记的公钥。这个标记很讲究——它看起来像遥测服务，不像攻击者的钥匙。攻击者借此获得无需密码即可 SSH 登录的能力。

第三类是尝试建立反向隧道。即使 SSH 远程登录因权限问题失败（多数 macOS 和 Windows 电脑默认不开 SSH 服务，且需要管理员权限），恶意代码仍然会尝试连接攻击者的服务器。

第四类是持久化。它在 macOS 和 Windows 上分别安装了后台脚本，设置为开机自启，每隔约 60 秒尝试重新连接。

恶意扩展执行链路

66 行代码干的事情，够写半页运维手册

这里有一个关键细节：攻击者的代码存在错误。大多数情况下，启用 SSH 远程登录这一步会失败——因为它需要管理员权限，而扩展通常以普通用户身份运行。但即使登录失败，信息收集和持久化脚本的安装可能已经完成了。

真正危险的不是"能不能远程连上"，而是"你的 SSH 配置里有没有多出一把陌生钥匙"。

供应链攻击为何选官方商城

这个事件最让人不舒服的地方，不在于攻击技术本身有多高超，而在于攻击者选择了什么路径。

官方插件商城的审核门槛天然比第三方渠道低。用户看到「Claude Code」这个名字、看到它在 Cursor Marketplace 里，第一反应是信任。攻击者不需要伪造签名、不需要绕过网关、不需要社会工程学诱导——只需要让包进入审核通过的队列。

Claude Code 本身也是一个精准选择。它是 Anthropic 推出的终端原生 AI 编程工具，热度高、用户群体集中（开发者），且通过 VS Code 扩展接口运行。这意味着安装它的人，大概率已经有 SSH 密钥、Git 凭据和远程服务器访问权限。拿到一把能 SSH 登录的钥匙，比拿到一堆日志有价值得多。

官方商城这个名字，就是最大的信任杠杆

Cursor 的安全公告没有说明攻击者是如何把包放进商城的。审计访问记录、轮换密钥、重建市场——这几步操作暗示发布链路或内部凭据出了问题。具体是哪一个，还需要等官方后续说明。

供应链攻击的演变趋势很清楚：以前是攻组件仓库（如 npm、PyPI），现在是攻IDE 的插件商城。用户对这些渠道的信任更直接，审核机制往往跟不上发布速度，而一旦被采纳，影响力是即时的、批量级的。

自查与修复清单

如果你在这 11 小时内安装了 Claude Code 2.1.313，以下是现在就能做的动作。

第一步：更新扩展。将 Claude Code 扩展升级到 2.1.314 或更高版本。这是 Cursor 官方推出的修复版本。

第二步：检查 SSH 密钥。运行以下命令检查是否有非预期的公钥：

grep -i "svc-telemetry" ~/.ssh/authorized_keys

如果有输出，说明你的机器已经被植入。删除那行密钥。

一行 grep 下去，才知道自己装了个什么东西

第三步：检查持久化脚本。在 macOS 上，查看以下路径：

- ~/Library/LaunchAgents/com.apple.sysmond.plist

- ~/.config/.smt

- ~/.config/.smtk

这些文件名故意模仿系统组件和遥测服务，肉眼扫过不容易发现异常。如果存在，删除它们。

第四步：运行 Cursor 官方提供的 remediate-macos.sh 脚本（适用于 macOS 用户）。

第五步：轮换凭据。假设这台机器上能访问到的所有凭据——Git 令牌、SSH 私钥、云服务 API 密钥——都已经泄露。从一台可信的设备上轮换它们。

第六步：检查网络流量。如果之前有反向隧道建立成功，攻击者可能已经获得了一定的访问能力。查看系统的网络连接记录，寻找异常的出站连接。

结论

官方插件商城不是免死金牌。

Cursor Marketplace 的名字前面加了「官方」两个字，但这次事件证明，这个名字只能保证商城归 Cursor 运营，不能保证每一个包的内容都经过 Anthropic 验证。发布渠道的信任背书，不等于包本身的真实性背书。

这件事留给开发者的判断很明确：在 X 条件下（使用的是官方商城、安装的是热门开源扩展、且扩展具有系统级权限），你应该在升级后做至少一次自动化扫描和一次手动核查；当条件变化为（扩展涉及 SSH、凭据管理或远程执行能力），信任链条就需要手动验证而不是默认接受。

今天就能做的三件事：更新扩展到 2.1.314，grep 一下 authorized_keys，检查 LaunchAgents 目录。花十分钟，比事后补救的成本低得多。

66 行恶意代码到底做了什么

Cursor 安全公告披露，攻击者没有重打包整个扩展，只修改了一个文件。在 Claude Code 2.1.313 扩展的主 JavaScript 文件头部插入了 66 行代码，插件其余部分保持原样，用户感觉不到异常，只要 Cursor 加载这个扩展，恶意脚本就自动执行。

插件商城里埋雷

信息采集：主机名、Git 邮箱、公网 IP、环境变量名

第一层动作是侦察。脚本读取主机名、系统架构、home 路径、当前工作目录，再通过 git config 获取关联邮箱，最后 curl 一个公网 IP 接口拿到出口 IP。环境变量这一步值得注意——官方说明只收集变量名，不收集变量值，目的是降低触发杀毒规则的概率，同时留下足够的指纹用于后续定向。

SSH 后门：注入 svc-telemetry 公钥，尝试反向隧道

第二层动作是安装钥匙。脚本向 ~/.ssh/authorized_keys 追加一条标记为 svc-telemetry 的公钥。这个名字刻意伪装成遥测服务，视觉上不容易被一眼识别。随后尝试在本地启动 SSH 服务，并打开一条反向隧道，让远端攻击者可以直接从外部连入。

持久化：开机自启脚本每约 60 秒重试连接

第三层是留后路。macOS 上脚本写入了 LaunchAgents 相关路径和 ~/.config/.smt、~/.config/.smtk 两个目录，Windows 上注册了开机自启项。这些持久化机制每隔约一分钟重试一次连接，只要 SSH 端口打开，攻击者就能恢复访问。

恶意代码执行链路

关键细节：多数机器因 SSH 未开而远程失败，但本地信息已泄露

Cursor 确认，大多数 macOS 和 Windows 机器默认未开启 SSH 远程登录服务，因此攻击者的反向隧道步骤在多数设备上未能成功。这意味着攻击者无法获得 Shell 访问权限。但信息收集这一步在扩展加载时就已经完成，主机名、邮箱、公网 IP 这些字段已经上传到攻击者的服务器。更需要注意的是，持久化脚本一旦写入磁盘，即使扩展被卸载，那把 SSH 钥匙和定时重试逻辑仍然留在系统里。

为什么选官方商城，而不是直接盗链

信任锚转移：用户默认信任 Marketplace 名称

这款恶意扩展的包名、版本号、展示名称都与官方 Claude Code 扩展完全一致。用户从 Cursor Marketplace 安装，天然带有信任背书。安全研究人员指出，这类攻击之所以在官方商城得手，是因为用户不再逐个核对发布者签名，而是依赖平台审核。

供应链的攻击面收缩：只攻一个入口就够了

攻击者不需要破解 Anthropic 的发布系统，也不需要绕过 VS Code 的验证机制，只要把恶意包塞进 Cursor Marketplace 这一条链路就完成了分发。攻击面从整个 AI 编程工具的生态收敛到一个入口，这是典型的供应链侧翼战。

更狠的是，你以为是 Anthropic 在更新，实际上是陌生人

扩展名称叫 Claude Code，用户以为是 Anthropic 在维护，其实包根本不是 Anthropic 发布的。Cursor 自己也在公告里反复强调这一点。这种命名混淆本身就是攻击的一部分，它把技术判断变成了品牌信任，而信任一旦被利用，验证成本就变得很高。

开发者每天装扩展，谁来装审核

攻击者的技术取舍

66 行完成四件事，没有花哨的工具链

从技术角度看，这 66 行代码没有任何第三方依赖，只用 Node.js 原生模块完成信息收集、文件操作和网络请求。这种极简设计降低了编译风险，也减少了被发现异常行为的可能性。

环境变量只取名字不取值，减少误报概率

取变量名比取变量值更安全——前者几乎不可能包含敏感字符串，不会触发终端安全软件的高危告警，但后者仍能提供足够的指纹用于追踪设备归属。

SSH 失败不等于全失败：本地持久化机制仍在运行

攻击目标不是立即拿到远程 Shell，而是先埋下一把钥匙，再等用户主动开启 SSH 服务或者手动运行某个远程调试命令。钥匙一旦到位，等待就变成了主要策略。对于企业开发者的机器来说，SSH 服务被管理员临时打开的概率远高于个人电脑。

为什么能上架：供应链攻击换了个入口

攻击者没有入侵 Anthropic 的任何系统，也没有窃取 Anthropic 的发布凭证。根据 Cursor 的安全公告和 X 上陈成的分析，恶意包是通过直接利用 Cursor Marketplace 的发布权限被替换上去的。官方至今没有公开说明是发布流程哪个环节出了问题，只提到审计了访问记录、轮换了密钥、重建了市场。

这不是第一次类似手法的前科。

Nx Console 在 2022 年就因为开发者账号泄露导致扩展被篡改，最终同时传播到 VS Code 和 Open VSX 两个市场。那次攻击面和这次类似，都是利用了官方市场的分发通道，区别只在于传播路径更广。

信任锚发生了转移。开发者习惯在 Cursor Marketplace 里搜索「Claude Code」，看到发布者名称和版本号匹配就点击安装。官方商城的名字本身就是信任背书，而攻击者不需要攻破 Anthropic 就能获得这种信任。供应链的攻击面因此收缩到了一个入口。

恶意扩展上架路径

AI 编程工具链的插件依赖比传统 IDE 更重。

Claude Code 本身是一个终端原生工具，但它通过 VS Code 扩展的形式进入 Cursor 生态，这本身就意味着一个额外的信任层。开发者在安装时默认信任 Marketplace 的审核机制，而攻击者只需要绕过这一层就够了。Cursor 后续宣布将逐步引入扩展签名验证，但目前的审核模型仍停留在事后响应阶段。

{ "title": "Cursor 官方插件商城现恶意 Claude Code 扩展，约 11 小时影响最多 5000 名开发者", "summary": "10 月 29 日，Cursor 官方插件商城出现被篡改的 Anthropic Claude Code 扩展 2.1.313，非 Anthropic 官方发布的包，分发约 11 小时，最多波及 5000 名开发者。恶意代码在扩展加载时自动执行，采集主机与 Git 信息、注入 svc-telemetry 标记的 SSH 公钥并尝试建立持久化反向隧道。Cursor 已下架并推 2.1.314 修复；本文拆解攻击机制与自查清单。", "opening_hook": "你从官方商城安装了 Claude Code 扩展，它在你机器上跑了约 11 小时，收集了主机名、Git 邮箱和公网 IP，还在 SSH 配置里塞进一把陌生钥匙。", "outline_markdown": "## 事件复盘：11 小时发生了什么

攻击时间线与影响面

恶意代码的四个动作

为何选官方商城

机制拆解：供应链攻击换了入口

信任锚的转移

攻击面的收缩逻辑

中招自查：现在就能做的四步

查 ~/.ssh/authorized_keys

确认扩展版本

macOS 用户清理残留

把官方市场当不可信输入

接下来盯什么

官方说明发布链路细节

同批 C2 基础设施关联事件

团队安全规范的更新落点",

"body_markdown": "## 事件复盘：11 小时发生了什么

Cursor 官方插件商城于 10 月 29 日出现被篡改的 Anthropic Claude Code 扩展，版本号为 2.1.313。太平洋时间凌晨 2:27 至下午 1:35，约 11 小时内分发，最多影响 5000 名开发者。攻击者并未改动原有合法功能代码，只是在扩展主文件前插入 66 行恶意加载器。

恶意代码执行四个动作：采集主机名、Git 邮箱、公网 IP 和环境变量名，向 ~/.ssh/authorized_keys 注入标记为 svc-telemetry 的陌生公钥，尝试开启本地 SSH 服务并建立反向隧道，最后在 macOS 安装 LaunchAgents 自启脚本、在 Windows 注册开机任务，每约 60 秒重试连接。

Cursor 确认多数机器因 SSH 默认未开而远程失败，但本地信息已泄露。随后下架恶意版本，一度关闭整个市场重建，并发布 2.1.314 修复。

参考文献

[1] AI编程工具Cursor官方插件商城出现恶意Claude Code插件_搜狐网. m.sohu.com/a/109537441… [2] AI编程工具Cursor官方插件商城出现恶意Claude Code插件_搜狐网. m.sohu.com/a/109537441… [3] 11 小时影响约 5000 开发者：AI 编程工具 Cursor 官方商城出现恶意 Claude Code 插件 - IT之家. www.ithome.com/1/020/466.h… [4] 11 小时影响约 5000 开发者：AI 编程工具 Cursor 官方商城出现恶意 Claude Code 插件_新浪科技_新浪网. finance.sina.com.cn/tech/digi/2… [5] AI编程工具Cursor官方插件商城出现恶意Claude Code插件_新浪财经_新浪网. finance.sina.com.cn/stock/t/202… [6] 陈成 on X: "Cursor 插件市场的恶意 Claude Code 扩展 1/ Cursor 10/29 披露安全事件：自家 VS Code 扩展市场里出现了被改过的 Anthropic.claude-code 2.1.313，这个版本不是 Anthropic 发布的。上架时间是太平洋时间 2:27am 到 1:35pm，约 11 小时，最多影响 5000 个用户，Cursor 说会逐个联系。 2/ 扩展会做四件事： - 收集主机名、用户名、系统、架构、home 路径、环境变量名、工作目录、Git 邮箱和公网 IP。官方写的是变量名，不是变量值。 - 往 authorized_ke… / X. x.com/chenchengpr… [7] 思维怪怪 on X: "10 月 29 日，Cursor 扩展商店遭到攻击。黑客将 Claude Code 插件的 2.1.313 版本替换成恶意安装包，试图远程控制用户电脑。该版本上架约 11 小时，Cursor 称最多有 5000 名用户受到影响。 安全研究人员发现，黑客只修改了插件的一个文件，在正常代码前插入 66 行恶意程序。插件看起来仍能正常使用，但只要 Cursor 加载它，恶意代码就会执行，不需要用户主动使用 Claude Code。 恶意程序会收集电脑名称、Git 邮箱、公网 IP 等信息，再偷偷添加黑客的 SSH 登录密钥，尝试开启远程登录，并让电脑主动连接黑客服务器。… / X. x.com/0xLogicrw/s… [8] Cursor扩展商店遭投毒：Claude Code被植入SSH后门. www.binance.com/zh-CN/squar…

延伸入口

- 原文归档：tobemagic.github.io/ai-magician…

- 公众号：计算机魔术师

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

You're going to install a normal Claude Code extension from the official plug-in mall.

Replay of the incident: 11 hours in the Official Business City

On October 29th, at 2:27 a.m., the Claude Code extension, version 2.1.13, appeared in Cursor Marketplace. At 1.35 p.m., it was laid off, back and forth for about 11 hours online.

It's not Anthropic publish's bag. Cursor confirmed this and noted that up to 5,000 developers downloaded and installed the extension in this 11 hours.

Who didn't think about "This is an official mall."

Cursor then closed the mall for a security audit, contacted the affected users on a case-by-case basis and sent the 2.1.3-14 version to request user updates.

The point of entry for the assailant was straightforward: a file was changed and 66 lines JavaScript was inserted before the normal code. The original functional code was almost intact and the extension seemed to work as usual. But Cursor just loads this extension, then 66 lines of malicious code will be executed, without the need for the user to open Claude Code.

What did you do with the malicious code?

Security researchers dismantled the malicious loader for line 66, which can be grouped into four categories.

The first is information collection. It acquires hostname, user name, operating system, architecture, home path, environment variable (not to mention variable name, not value), working directory, Git Mailbox and public network IP. This information was packaged and sent to the attacker-controlled server.

The second category is SSH rear door implants. The malicious code adds a public key with the svc-telemetry tag to ~/.ssh/authorized keys. That's a good sign -- it looks like a telemetry service, not like the key to the attacker. This enables the attackers to access SSH without password.

The third category is the attempt to establish a reverse tunnel. Even if the SSH remote login fails because of the permission problem (most MacOS and Windows computers default on SSH services and require administrator permission), the malicious code will try to connect to the attacker's server.

The fourth category is sustainability. It installs backstage scripts on MacOS and Windows, respectively, set for startup, and tries to reconnect every approximately 60 seconds.

Malicious extension of the enforcement chain

That's a half-page manual.

Here's a key detail: the assailant's code is wrong. In most cases, the move to enable SSH remote login will fail - because it requires permission as an administrator, and the extension usually runs as an ordinary user. However, even if the login failed, the installation of information-gathering and sustainable scripts may have been completed.

The real danger is not "can we connect remotely" but "do you have an extra strange key in your SSH configuration"?

Why did the supply chain attack the official mall?

The most uncomfortable part of the incident is not how sophisticated the attack technology is in itself, but what path the attackers choose.

Official plug-in malls naturally have lower clearance thresholds than third-party channels. The user saw the name Claude Code, saw it in Cursor Marketplace, and the first reaction was trust. The attackers did not need forged signatures, bypassed the gateway, and did not need social engineering inducements — only to place the bag in the queue for clearance.

Claude Code itself is a precise choice. It is an end-state AI programming tool launched by Anthropic, with high heat, a concentration of user groups (developer) and an extended interface through VS Code. This means that the person who installed it probably already has SSH key, Git certificate and remote server access to permission. Getting a key to SSH login is much more valuable than getting a bunch of journals.

The name of the official mall is the biggest bar of trust. Bar

Cursor's security announcement did not indicate how the attackers put the bag in the mall. Audit access records, rotation keys, re-establishing markets — these steps suggest problems with the publish link or internal evidence. In particular, an official follow-up note is required.

The evolution of supply chain attacks is clear: it used to attack the assembly warehouse (e.g. npm, PyPI) and it is now the mede plug-in. Users have more direct confidence in these channels, and auditing mechanisms often fail to keep pace with publish, and once adopted, the impact is immediate, mass-scale.

Self-checking and rehabilitation list

If you have Claude Code 2.1.13 in 11 hours, the following is the action you can do now.

Step 1: Update expansion. Upgrade Claude Code to 2.1.314 or higher. This is the official Cursor release of the restoration.

Step 2: Check for SSH keys. Run the following commands to check for unexpected public keys:

grep -i "svc-telemetry" ~/.ssh/authorized_keys

If there's an output, it means your machine has been implanted. Remove the line key.

One line, grep, go down and know what you've got.

Step 3: Check for durable scripts. On MacOS, see the following path:

- ~/Library/LaunchAgents/com.apple.sysmond.plist

- ~/.config/.smt

- ~/.config/.smtk

These documents are intended to imitate system components and telemetry services, and it is not easy to detect anomalies when the body is cleaned. If they exist, delete them.

Step four: Run the officially supplied remediate-macos.sh script (for MacOS users).

Step 5: Rotation. It is assumed that all the evidence available on this machine — the Git token, the SSH private key, the cloud service API key — has been leaked. Rotate them from a credible device.

Step 6: Check network traffic. If a reverse tunnel had been established previously, the attackers might have gained some access capability. View the system's network connection records and look for an unusual out-of-station connection.

Conclusions

The official plug-in is not a gold medal.

The name of Cursor Marketplace was preceded by the word “official”, but the incident proved that it could only guarantee that the city was run by Cursor and that the contents of each package were validated by Anthropic. An endorsement of confidence from the publish channel does not amount to a genuine endorsement of the package itself.

This matter is clear to the developers: under X conditions (using official malls, installing hot-door open-source extensions, and extending systems-level permission), you should do at least one automated scan and one manual verification after upgrading; when conditions change (expansion involves SSH, certificate-based management, or remote execution capabilities), the chain of trust requires manual validation, not tacit acceptance.

Three things that can be done today: an update expanded to 2.1.14, grep a little bit, checked the LaunchAgents directory. It takes 10 minutes, much less than the cost of ex post facto remediation.

What exactly did the malicious code do?

The Cursor Security Bulletin disclosed that the attackers had not repackaged the entire extension and had only modified one document. 66 lines of code were inserted in the head of the JavaScript file in Claude Code 2.1.13, the rest of the plugin remains as it is and the user does not feel abnormal, and the malicious script is automatically executed as long as Cursor loads this extension.

Plugin Business City Mines

Information acquisition: host name, Git mailbox, public network IP, environment variable First Name

The first level of action is reconnaissance. Script to read host name, system architecture, home path, current working directory, then get associated mailboxes through guit config, and finally curl a public network IP interface to export IP. This step in environmental variables is noteworthy — the official statement is that only the names of the variables are collected, and not the values of the variables, with the aim of reducing the probability of triggering the poisoning rule, while leaving sufficient fingerprints for subsequent orientation.

SSH Backdoor: injection of svc-telemetry public key, attempt reverse tunnel

The second level of action is the installation of the key. Add a public key marked svc-telemetry to ~/.ssh/authorized keys. This name is deliberately disguised as a telemetry service, which is not easily visualized. An attempt was then made to launch SSH services locally and open a reverse tunnel to allow remote attackers to enter directly from the outside.

Endurance: Open self-starter scripts are connected to retry for approximately 60 seconds

The third level is left behind. Scripts on macos have written about the LaunchAgents path and two directories ~/.config/.smt, ~/.config/.smtk, and Windows has registered the startup item. These sustainability mechanisms are connected every approximately one minute to retry, and the attackers can resume access as long as the SSH port is open.

Malicious code implementation link

Key details: Most machines failed remotely because SSH was not operational, but local information leaked

Cursor confirmed that most MacOS and Windows machines had defaulted on the SSH remote log-in service, so that the attackers ' reverse tunnel steps failed on most devices. This means that the attackers could not obtain Shell access to permission. However, this step in information gathering was completed at the time of the expansion of loading, and the host name, the mailbox, the Internet IP, these fields were uploaded to the attackers ' servers. It is even more important to note that the SSH key and the timing retry logic remain in the system once the durable script is written on disk, even if the extension is unloaded.

Why the official mall instead of the direct chain?

Trust anchor transfer: user default trust Marketplace name

This maliciously extended package name, version number, display name is exactly the same as the official Claude Code expansion. User installed from Cursor Marketplace with natural endorsement of trust. According to security researchers, such attacks were successful in official malls because users no longer checked the signatures of publishers individually but relied on platform audits.

The supply chain is shrinking: just one entrance is enough.

The attackers did not have to break the publish system of Anthropic, nor did they need to bypass the VS Code verification mechanism, and the distribution was completed by simply plugging the malicious package into Cursor Marketplace. The face of the attack constricted from the ecology of the entire AI programming tool to an entry point, a typical supply chain flank.

Even worse, you think it's Anthropic updating, actually strangers.

The extension is called Claude Code, and the user thinks Anthropic is maintaining, and the package is not actually Anthropic publish. Cursor himself has repeatedly emphasized this in his bulletin. This confusion in naming itself is part of the attack, which transforms technical judgement into brand trust, and once used, the cost of certification becomes high.

The developer loads up every day. Who's gonna do it? Nuclear

The technical trade-offs of the attackers

There's no fancy tool chain.

From a technical point of view, this 66-line code does not rely on any third party, but only on the Node.js prototype module to complete information collection, file operations and network requests. Such a condensed design reduces the risk of codification and reduces the likelihood of detection of unusual behaviour.

Environmental variables are named without value, reducing the probability of misrepresentation

It is safer to use a variable name than a variable value — the former is almost impossible to contain a sensitive string and does not trigger a high-risk alert for terminal security software — but the latter can still provide sufficient fingerprints for tracking equipment attribution.

SSH failure does not mean total failure: local sustainability mechanisms are still operational

The target of the attack was not to immediately get a remote Shell, but to bury the next key and wait for the user to initiate SSH service or manually run a remote debug command. Once the key is in place, waiting becomes the main strategy. For business developers ' machines, SSH services are much more likely to be temporarily opened by administrators than personal computers.

Why? The supply chain attack changed the entrance.

The attackers did not invade any system in Anthropic, nor did they steal a publish certificate from Anthropic. According to Cursor ' s security announcement and X-exact analysis, the malicious package was replaced by publishpermission, which directly uses Cursor Marketplace. To date, no official account has been made of which part of the publish process has gone wrong, except for the audit of access records, the rotation of keys and the rebuilding of markets.

This is not the first history of similar tactics.

Nx Console was tampered with in 2022 because of the development account leak, which eventually spread to both VS Code and Open VSX markets. That attack and the similar use of distribution channels in the official market, the difference being only the wider distribution path.

The trust anchor has been diverted. Developers are used to searching "Claude Code" in Cursor Marketplace, and click on installation when publish matches its name and version number. The name of the official mall is in itself an endorsement of trust, and the attackers need not break through Anthropic to gain that trust. As a result, the face of the supply chain contracted to an entry point.

Malicious extension of upper shelf path

The plugin for the AI programming tool chain is more heavy than the traditional IDE.

Claude Code itself is an end-state tool, but it enters Cursor ecology in the form of an extension from VS Code, which in itself means an additional layer of trust. Developer defaults to trust the Marketplace clearance mechanism at installation, and the attackers need only bypass this level. Cursor subsequently announced the gradual introduction of extended signature certification, but the current audit model is still in the after-action phase.

{ "title " : "Cursor official plug-in mall is now maliciously Claude Code expansion, affecting up to 5,000 developers for about 11 hours", "summary": "On October 29, Cursor official plug-in mall was presented with a tampered Anthropic Claude Code extension 2.1.13, non-Anthropic official publish package, distributed for approximately 11 hours with up to 5,000 developers. The malicious code is automatically executed when extended loading, collects host and Git information, injects SSH keys into the svc-telemetry tag and attempts to create a permanent reverse tunnel. Cursor has been laid down and pushed 2.1.314 repaired; this paper dismantles the attack mechanism and self-check list. "Popening hook": "You installed Claude Code from the official mall, and it ran on your machine for about 11 hours, collected host names, Git mailboxes and public network IPs, and inserted a strange key into the SSH configuration. ", "outline markdown":

Timeline and impact of the attack

Four actions of malicious code.

Why the official mall?

Mechanism dismantled: supply chain attacks replaced access

Transfer of trust anchors

The logic of contraction in the face of attack.

Check yourself: Four steps now.

~.ssh/authorized keys

Confirm Extension

MacOS User Clear Residues

Make the official market untrustworthy.

What's next?

Official description of publish link details.

C2 infrastructure linkage events

Team security code update points."

"body markdown": "# Crash: 11 hours"

Anthropic Claude Code, version 2.1.13, was tampered with on October 29. Pacific time 2:27 a.m. to 1:35 a.m., distributed within approximately 11 hours, affecting up to 5,000 developers. The attackers did not change the original legitimate functional code but simply inserted 66 malicious loaders before expanding the main file.

Malicious code executes four actions: collecting hostnames, Git mailboxes, public network IPs and environmental variables, injecting strange public keys marked svc-telemetry to ~/.ssh/authorized keys, trying to open local SSH services and set up reverse tunnels, and finally installing LaunchAgents self-starter scripts in MacOS, registering on Windows for start-up missions, retry connections per 60 seconds.

Cursor confirmed that most machines failed remotely because SSH defaulted, but local information was leaked. This was followed by a malicious version that closed the entire market for one time and repaired publish 2.1.114.

References

[Original: English] The upper shelf is 2.27am to 1:35pm, about 11 hours, affecting up to 5,000 users, Cursor says to contact one by one. 2/ Extension will do four things: - Collect host name, user name, system, architecture, home path, environmental variable name, working directory, Git mailbox and public network IP. The official name is a variable, not a variable value. - On X: " October 29, Cursor Extension Shop was attacked. The hacker replaced version 2.1.13 of the Claude Code plugin with a malicious installation package in an attempt to remotely control the user computer. The version is about 11 hours old and Cursor claims that up to 5,000 users were affected. Security researchers found that hackers modified only one file of the plugin by inserting 66 malicious programs before the normal code. The plugin still appears to be functional, but as long as Cursor loads it, the malware code will be enforced without the user using Claude Code on its own initiative. The malware program collects information about computer names, Git Mailboxes, Internet IPs, then secretly adds hacker's SSH login keys, tries to open remote login and allows the computer to actively connect to the hacker server..../X.x.com/0xLogicrw/s...[8] Cursor extension store was poisoned: Claude Code was implanted in the SSH back door. www.binance.com/zh-CN/squar...

Extension entrance

- Original archive: tobemagic.github.io/ai-magician...

- WeChat Official Account: Computer magician

Auto-fetched and translated by AI Atlas. All rights belong to the original author.