你打开VS Code或Cursor，等加载完插件，背后可能已经有人拿着你的SSH key在监听你了。
一、事件经过：一个扩展背后的11小时
Claude Code扩展版本2.1.313在Cursor市场被发现被篡改
2026年10月29日，Cursor市场出现了一个被恶意篡改的Claude Code扩展。版本号为2.1.313，比官方正常的2.1.314早一天上线，存在时间约11小时。安全团队StepSecurity和OpenSourceMalware先后发布报告，指出该包被注入了约66行恶意JavaScript代码。
Cursor的安全公告确认，这一恶意版本「并非由Anthropic开发」。但问题在于，它出现在Cursor自己的VS Code扩展市场，用的是Anthropic的公司名称和官方扩展标识。
恶意代码触发机制：无需开发者主动对话即可执行
恶意代码的执行时机是扩展初始化阶段。这意味着开发者不需要启动任何AI对话、不需要点击任何按钮、不需要输入任何命令——只要VS Code或Cursor启动并加载了该扩展，脚本就会自动运行。
终端里默默跑了一段你不知道的脚本
脚本收集的信息包括：主机名、用户名、环境变量、Git邮箱配置和公网IP。随后向~/.ssh/authorized_keys追加一个未授权公钥，标签刻意写成「svc-telemetry」，试图伪装成合法的服务遥测密钥。
Cursor下架并建议升级至2.1.314
发现异常后，Cursor立即下架了2.1.313版本，并发布2.1.314作为修复版本。公司通过X平台发帖，说明事件影响上限为5000名用户，并计划直接联系受影响者。Anthropic同步澄清：其自身系统未被入侵，攻击者利用的是Cursor市场的发布权限。
二、攻击路径：为什么官方名义的插件也会被寄生
Cursor市场发布权限 vs Anthropic自身系统
这一事件的本质不是「Anthropic的系统被攻破」，而是「Cursor市场的发布渠道被劫持」。扩展市场通常允许第三方提交包，通过审核流程后上架。攻击者很可能获取了某个具备发布权限的账户——可能是通过凭证泄露、社会工程或内部人员失误。
权限边界之外的信任盲区
Cursor市场与Open VSX两个注册表同时出现该恶意包，说明攻击者利用了跨平台的分发漏洞。Open VSX作为VS Code生态的开放注册表，审核机制相对宽松，更容易成为恶意包的跳板。
Nx Console同类事件：供应链连环暴露
同一天，Nx开发团队也发布安全公告，证实Nx Console的VS Code延伸套件被植入恶意代码。这起事故的根因是某位开发者遭遇TanStack供应链攻击，GitHub凭证外流，攻击者得以冒充其身份触发构建流程，将恶意代码推送至GitHub存储库并自动发布。
两起事件相隔不足48小时，暴露出同一个结构性问题：当扩展依赖的供应链任一环节失守，下游分发渠道就会成为传导节点。
三、技术细节：恶意代码做了什么
SSH后门持久化机制
恶意代码的核心目标是持久化访问。具体步骤如下：
扩展初始化 → 收集主机信息 → 追加SSH公钥到authorized_keys → 尝试启动本地SSH守护进程 → 发起反向隧道连接
公钥被标记为「svc-telemetry」是为了降低用户的警惕性——如果有人在代码审查中发现这个密钥，可能会误以为是合法的遥测服务所添加。
一次初始化，三条通道同时生效
攻击者不满足于一次性窃取数据。反向隧道的设计意味着：即使开发者删除了公钥、卸载了扩展，只要主机未被重建，攻击者仍可能通过残留的SSH配置或内存中的进程维持访问能力。
攻击者的目标：反向隧道而非一次性窃取
典型的供应链窃密攻击往往以一次性数据外泄为目标——拿就走人。但这次攻击的目标是建立「持久化隧道」。
持久化隧道的价值在于：它把单次入侵转化为持续监听能力。攻击者可以长期回收新产生的SSH密钥、环境变量中的API Token、以及后续代码写入的敏感内容。
CellCog在安全报告中给出的判断非常直接：「重建主机比假设清除残留文件更可靠。」这不是建议，而是基于SSH后门技术特性的判断——一旦authorized_keys被写入且SSH守护进程被触发，本地清理很难保证没有残留入口。
四、取舍与判断：开发者现在该怎么做
清理 vs 重建主机的边界
对于普通个人开发者，如果仅安装了2.1.313版本且在11小时窗口期内未进行任何敏感操作，可以采取以下清理步骤：
- 检查~/.ssh/authorized_keys，移除所有标记为「svc-telemetry」的公钥
- 检查SSH配置文件~/.ssh/config，移除异常的Host条目
- 重启SSH守护进程，验证无异常监听端口
- 更换受影响主机上的所有SSH密钥
但如果该主机用于企业环境、持有生产凭证、或曾被用于访问核心仓库，「重建主机」是唯一可信的选项。原因很简单：攻击者可能在初始化脚本执行期间已将内存中的凭证转储到外部，本地清理无法验证是否已发生。
重装系统是最后一道防线
插件生态信任模型的根本问题
这起事件暴露了AI编程工具生态的一个根本矛盾：用户信任的是Anthropic的品牌，但实际安装的是经过Cursor市场审核的包。品牌方与分发渠道的信任边界并不重合。
在X平台上，用户@indie_alx追问了一个关键问题：「一个被修改的构建版本，究竟是如何以官方Anthropic名义发布的？」这个问题至今没有完整答案。可能的路径包括：发布权限的账户凭证泄露、市场审核流程的绕过、或第三方开发者账户被劫持。
对团队而言，今天可以做的三件事：
- 立即检查团队中所有使用Cursor或VS Code + Claude Code扩展的主机，确认版本号是否为2.1.313或更低
- 对涉及生产环境的主机执行重建，而非仅清理SSH配置
- 审查团队GitHub凭证的分发权限，排查是否存在类似TanStack攻击的供应链传播路径
当AI编程助手变成了攻击入口，我们信任的不是代码质量，而是分发渠道本身。而分发渠道的信任链，恰好是这次事件中最脆弱的一环。
五、信任的重建：当AI编程助手变成了攻击入口
这次事件的核心问题不是技术漏洞，而是信任结构的错位。开发者信任Anthropic的品牌，信任Cursor市场的审核机制，信任「官方插件」这个标签。攻击者利用的正是这种信任链。
真相锁定：发布权限 vs 官方系统
Cursor市场有自己的发布权限体系，与Anthropic的官方发布系统是分离的。攻击者没有入侵Anthropic的内部系统，而是获得了Cursor市场的发布权限。这两个系统的边界，就是这次攻击的入口。
Nx Console和ETHcode的遭遇说明了同一件事：供应链攻击的路径正在被批量复制。攻击者不再需要直接入侵官方系统，只需要找到一个信任度足够高的分发渠道，就能触达大量用户。
分发渠道信任 vs 代码质量信任
传统软件工程中，开发者信任代码质量本身——通过代码审查、测试覆盖、签名验证来建立信任。AI编程助手的场景改变了这个结构：用户安装扩展时，信任的是分发渠道，而不是对代码本身的验证。
这种信任结构有一个明确的代价：一旦分发渠道被渗透，信任链条会整体断裂。开发者需要意识到这一点，并建立自己的验证机制。
每个项目该做的两件事
第一，建立扩展安装的审计清单。记录每个扩展的来源、版本、安装时间，定期对照官方渠道进行校验。这不是为了增加工作量，而是为了在事件发生时能快速定位影响范围。
第二，对SSH密钥等敏感资产设置独立的管理流程。不要把开发环境的认证凭据与日常开发工具放在同一个信任域内。攻击者通过扩展拿到SSH密钥，下一步可能是横向移动到生产服务器。把这个边界切断，能显著降低单次漏洞的影响面。
每一次扩展更新，都是一次信任投票
更狠的是，这种信任结构的重建成本，远高于一次简单的扩展更新。开发者需要在便利和安全之间做出取舍，而这个取舍的标准，正在被一系列类似事件重新定义。
这次事件的落点很明确：在扩展生态高度集中的平台，用户的安全边界取决于平台的治理水平，而不是自己对代码的理解。
今天的动作很简单：检查版本、检查SSH、检查进程。如果发现异常，不要试图清理，重建主机是最干净的选择。后续我会持续关注Anthropic和Cursor在这件事上的技术复盘，以及扩展市场的治理机制是否会有实质性调整。
参考文献
- Cursor官方安全公告: x.com/cursor_ai/s…
- Reuters报道: www.reuters.com/business/me…
- StepSecurity技术分析: www.helpnetsecurity.com/2026/10/30/…
- OpenSourceMalware报告: starmap.dbappsecurity.com.cn/info/16820
- CellCog安全建议: cellcog.ai/blog/claude…
- Nx Console供应链攻击公告(CVE-2026-48027): www.ithome.com.tw/news/[REDAC…] 你打开Cursor，等加载完插件，背后可能已经有人拿着你的SSH key在监听你了。 版本2.1.313的Claude Code扩展，在被安装后的首次初始化阶段，就触发了那66行JavaScript代码。不需要开发者打开对话窗口，不需要确认权限，扩展一加载完，脚本就开始跑。
真相锁定
信息收集阶段
第一步是悄悄爬取你的主机指纹。脚本读取host name、当前用户名、环境变量、Git配置里的邮箱地址，再加上一次主动请求拿公网IP——这五样信息足够攻击者定位你是谁、你在哪个网络、以及你能否被反向连接。整个过程没有弹窗，没有日志提示，IDE的状态栏也不会多一行警告。
SSH后门植入
第二步更直接。脚本在你电脑上的~/.ssh/authorized_keys文件末尾追加一行公钥，标签是"svc-telemetry"。这个词看起来像某个合规的服务账号标识，目的是让这行注入在人工审计时被忽略。攻击者的公钥一旦进入授权列表，就具备了免密登录你机器的能力。
终端命令流
持久化尝试
有了公钥还不够。脚本接下来尝试在本机启动SSH守护进程，并建立一条反向隧道，目标是把内网机器暴露到攻击者的远程控制节点上。这意味着即使用户卸载了这个恶意扩展，残留的authorized_keys条目仍然有效——更狠的是，这比重新安装一个干净版扩展更难发现。
"重建主机比假设清除残留文件更可靠"——安全星图平台在事件报告中的原话，也是对所有"我卸载了就安全了"的开发者最直接的提醒。
分发路径：为何官方名义也会被寄生
问题不在Anthropic的系统，而在Cursor市场的发布权限。攻击者不需要入侵Anthropic的代码仓库，也不需要伪造签名——他们只需要混进Cursor Marketplace的审核流程，把一个名字看起来官方、版本号紧跟着真实发布的包提交上去。2.1.313这个版本号，刻意贴近官方2.1.312，让许多依赖自动更新的开发者根本不会察觉差异。 这才是这次事件真正的机制层面教训：当AI编程助手变成了攻击入口，我们信任的不是代码质量，而是分发渠道本身。
- 安全星图平台：恶意Claude Code扩展在Cursor市场植入SSH后门 - starmap.dbappsecurity.com.cn/info/16820
- Reuters：Cursor says up to 5,000 users affected by tampered Claude Code extension - www.reuters.com/business/me…
- Help Net Security：Claude Code extension poisoned with persistent SSH backdoor - www.helpnetsecurity.com/2026/10/30/…
- The Hacker News：Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor - thehackernews.com/2026/10/off…
- DEV Community：A Trojanized Claude Code Extension Hit Up to 5,000 Cursor Users - dev.to/lycore/a-tr…
- iThome：Nx Console的VS Code延伸套件被植入窃资软件 - www.ithome.com.tw/news/[REDAC…]
- CellCog：Claude Code Extension Backdoored on Open VSX - cellcog.ai/blog/claude…
延伸入口
- 原文归档：tobemagic.github.io/ai-magician…
- 公众号：计算机魔术师
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
You open the VS Code or Cursor, and when you're finished loading the plug, someone may already be watching you with your SSH key.
I. Incidents: 11 hours behind an extension
Claude Code Extension 2.1.13 was found tampered with at Cursor Market.
On 29 October 2026, the Cursor market witnessed a maliciously altered Claude Code expansion. The version, 2.1.13, was online one day before the official 2.1.134 and existed for approximately 11 hours. The security team StepSecure and OpenSourceMalware reported publish, stating that the package had been injected into approximately 66 malicious JavaScript codes.
Cursor's security announcement confirms that this malicious version is “not developed by Anthropic”. The problem, however, is that it appears in Cursor's own VS Code market expansion using the company name and official extension logo of Anthropic.
Malicious code trigger mechanism: implementation without a developer ' s active dialogue
The implementation of the malicious code is timed to expand the initialization phase. This means that the developers don't need to start any AI conversations, click no buttons, enter no commands -- - As long as VS Code or Cursor initiates and loads the extension, the script will run automatically.
It's a script you don't know about.
Scripts collect information on: host name, user name, environment variable, Git mailbox configuration and public network IP. Subsequently, an unauthorized public key was added to ~.ssh/authorized keys, with the label deliberately written as "svc-telemetry", in an attempt to disguise it as a legitimate service telemetry key.
Cursor down and recommended for upgrade to 2.1.3114
Upon discovery of the anomaly, Cursor immediately removed version 2.1.313 and publish 2.1.1314 as a restorative version. Through platform X, the company posted an incident impact ceiling of 5,000 users and plans to directly contact those affected. Anthropic simultaneously clarified that its own system had not been invaded and that the attackers had used publishpermission in the Cursor market.
II. The route of the attack: why official plugins are also parasites
Cursor Market publishpermission vs Anthropic own system
The essence of the incident was not "Anthropic's system was broken", but "the publish channel of Cursor's market was hijacked". The extended market usually allows third parties to submit the package and to go up through the vetting process. The attackers were likely to have access to an account with publishpermission — possibly through documents leaking, social engineering or internal personnel error.
permission Trust Blind Zone Beyond Borders
The fact that the Cursor market coincided with the Open VSX registration form showed that the attackers had exploited the distribution gap across the platform. Open VSX, as an open registration form for VS Code ecology, has a relatively relaxed auditing mechanism that makes it easier to become a springboard for malicious packages.
Nx Console-like event: supply chain exposure
On the same day, the Nx development team also issued a publish security announcement confirming that Nx Console ' s VS Code extension was implanted into a malicious code. The incident was caused by an attack on the TanStack supply chain by a certain developer, the outflow of GitHub vouchers, which allowed the assailant to act as an identity trigger to the construction process, push the malicious code to the GitHub repository and automate publish.
The two incidents were less than 48 hours apart, exposing the same structural problem: When any link in the supply chain upon which the expansion depends fails, downstream distribution channels become nodes of transmission.
III. Technical details: what the malicious code does
SSH Backdoor Sustainability Mechanism
The core objective of the malicious code is to sustain access. Specific steps are as follows:
Expand Initialisation Zoom Collect Host Information Zoom Add SSH Public Key to Southorized keys Zoom Try to start local SSH daemons Zoom Start Reverse Tunnel Connection
The public key is marked as "svc-telemetry" in order to reduce user alertness - if someone finds this key in a code review, they may mistakenly think it is a legitimate telemetry service added.
First-time initialization, three corridors simultaneously.
The attackers were not content to steal data once. The design of the reverse tunnel means that even if the developer removes the public key and unmounts the extension, as long as the mainframe is not rebuilt, the assailant may still maintain access through the remaining SSH configuration or memory process.
Target of the attackers: reverse tunnel, not one-off theft
Typical supply chain hacking attacks often target one-off data leakage — taking off. However, the aim of the attack was to establish a “long-lasting tunnel”.
The value of a sustainable tunnel is that it transforms a single invasion into a continuous listening capability. The attackers can recover newly created SSH keys over a long period of time, API Token in environmental variables, and the sensitive content of subsequent codes.
The judgment given by CellCog in the safety report is very straightforward: "Rebuilding the mainframe is more reliable than assuming the removal of residual documents. This is not a recommendation, but rather a judgement based on the technical characteristics of the SSH back door - once it is written and the SSH daemon is triggered, local clean-up is difficult to guarantee that there are no remaining entry points.
IV. A trade-off and judgement: what do developers do now?
Clear vs rebuild host boundary
For ordinary personal developers, the following clean-up steps may be taken if only version 2.1.13 is installed and no sensitive operation is performed during the 11-hour window:
-Check ~.ssh/authorized keys, remove all public keys marked "svc-telemetry"
- Check the SSH profile ~/.ssh/config and remove the abnormal Host Contents
- Reactivate the SSH daemon and verify that there is no abnormal wiretap. mouth
- Replace all SSH keys on the affected host
However, if the host is used in the business environment, holds a production certificate, or has been used to access the core warehouse, "rebuilding the mainframe" is the only credible option. The reason is simple: the attackers may have stored the memory during the initialization of the script and the local clean-up could not verify whether it had occurred.
Reloading is the last line of defense.
Fundamental issues of the eco-trust model of the plugin
This incident revealed a fundamental contradiction in the ecology of the AI programming tool: Users trusted the Anthropic brand, but the package was actually installed after the Cursor market review. The boundaries of trust between brand players and distribution channels do not overlap.
On platform X, the user @indie alx asked a key question: "How can a modified version of the construction be publish in the name of official Anthropic? This question has not yet been fully answered. Possible pathways include the disclosure of publishpermission account vouchers, the circumvention of the market audit process, or the hijacking of third-party developers ' accounts.
For the team, three things can be done today:
- Check immediately all hosts in the team using Cursor or VS Code + Claude Code extensions to confirm whether version number 2.1.1313 or lower
- Implementation of the reconstruction of mainframes involved in the production environment, rather than cleaning up SSH configurations
- Review team GitHub ' s distribution of permission to check for supply chain transmission pathways similar to TanStack ' s attack
When the AI programming assistant turns into an attack portal, we trust not code quality, but distribution channels themselves. The chain of trust in the distribution channels coincided with the most vulnerable link in the incident.
V. Rebuilding trust: when AI programming assistant became the entrance to the attack
The core issue of this event is not a technical loophole, but the faulty structure of trust. The developers trust the Anthropic brand, the Cursor market auditing mechanism, and the "official plugin" label. It is this chain of trust that the attackers exploit.
Truth Lock: publishpermission vs Official System
The Cursor market has its own system of publishpermission, which is separate from the official publish system of Anthropic. Instead of hacking the internal system of Anthropic, the attackers obtained publishpermission from the Cursor market. The border between these two systems is the entry point of the attack.
The experiences of Nx Console and ETHcode illustrate the same thing: the path of supply chain attacks is being replicated in bulk. The attackers are no longer required to enter the official system directly, but to find a distribution channel of sufficiently high confidence to reach a large number of users.
Distribution channel trust vs code quality trust
In traditional software engineering, developers trust the code quality itself — through code review, test coverage, signature verification. The scenario of the AI programming assistant changed the structure: when the user installed the extension, it was the distribution channel that was trusted, not the authentication of the code itself.
There is a clear price for this trust structure: once distribution channels are infiltrated, the chain of trust breaks. Developers need to be aware of this and establish their own certification mechanisms.
Two things for each project.
First, an audit list of extended installations is established. The source, version and time of installation of each extension are recorded and periodically verified against official channels. This is not intended to increase the workload, but rather to enable quick mapping of the impact in the event of an incident.
Second, there is an independent management process for sensitive assets such as SSH keys. The certification of the development environment should not be placed in the same trust area as the day-to-day development tool. The attackers obtained SSH keys by extension, and next step may have moved horizontally to the production server. Cutting this border will significantly reduce the impact of a single loophole.
Every extension is a vote of confidence.
Worse still, the cost of rebuilding this trust structure is much higher than a simple extension. Developers need to make trade-offs between convenience and security, a criterion that is being redefined by a series of similar events.
The location of the event was clear: in expanding the ecologically highly concentrated platform, the user ' s safe boundaries depended on the platform ' s level of governance rather than its own understanding of the code.
Today's move is simple: check the version, check the SSH, check the process. If anomalies are detected and no attempt is made to clean them up, rebuilding the mainframe is the cleanest option. I will continue to follow up on the technical overlap between Anthropic and Cursor on this matter and whether there will be substantive adjustments in the governance mechanisms to expand the market.
References
- Cursor Official Security Bulletin: x.com/cursor ai/s...
- Reuters: www.reuters.com/business/me...
- StepSecurity Technical Analysis: www.helpnetsecurity.com/2026/10/30/...
- Opensource Malware Report: starmap.dbappsecurity.com.cn/info/16820
- CellCog Safety Proposal: cellcog.ai/blog/claude...
- Nx Console Supply Chain Attack Bulletin (NPR) CVE-2026-48027: www.ithome.com.tw/news/[REDAC...] When you open Cursor, when the plug is loaded, someone may already be watching you with your SSH key. The Claude Code extension of version 2.1.13 triggers the 66 lines JavaScript during the initial phase of installation. There is no need for developers to open dialogue windows, no need to confirm permission, and the script starts running as soon as it is loaded.
Truth lock.
Information-gathering phase
The first step was to sneak up on your machine. Script to read host name, current user name, environment variable, mailbox address in Git configuration, plus a voluntary request for a public web IP -- These five pieces of information are enough to locate who you are, which network you are on, and whether you can be connected in reverse. There are no bullet windows throughout the process, no log tips, and Ide's status bar does not have an additional line of warning.
SSH rear door implant
The second step is more direct. Scripts add a line of public keys to the end of ~/.ssh/authorized keys file on your computer with the label "svc-telemetry". The term appears to be a compliance service account sign, which is intended to inject the line into a manual audit to be ignored. Once the attacker's public key enters the authorization list, it has the ability to access your machine without confidentiality.
Terminal command stream
Enduring Attempts
It's not enough with public keys. The script then attempts to activate the SSH daemon on this machine and to create a reverse tunnel, with the goal of exposing the inner network machine to the aggressor ' s remote control node. This means that even if the user unmounted this malicious extension, the remaining entries of authorized keys remain valid — even worse, it is more difficult to detect than re-installing a clean version of the extension.
"Reconstructing the mainframe is more reliable than assuming that the remaining files are cleared" -- the original version of the SSS platform in the incident report is also the most direct reminder to all developers who "I unloaded and safe."
Distribution path: why official names are also parasitic
The problem is not the Anthropic system, but publishpermission in Cursor. The assailants did not need to invade Anthropic's code warehouse, nor did they need to forge signatures - All they have to do is get into Cursor Marketplace's vetting process and submit a name that looks official, version number immediately following the real publish package. 2.1.13 This version, which is deliberately close to the official 2.1.1312, leaves many developers relying on automatic renewals without detecting differences. That is the real institutional lesson of this event: when the AI programming assistant is turned into an attack portal, we trust not the quality of the code, but the distribution channel itself.
- Safety map platform: malicious Claude Code extended into the SSH back door at Cursor market -starmap.dbappsecurity.com.cn/info/16820
- Reuters：Cursor says up to 5,000 users affected by tampered Claude Code extension - www.reuters.com/business/me…
- Help Net Security：Claude Code extension poisoned with persistent SSH backdoor - www.helpnetsecurity.com/2026/10/30/…
- The Hacker News：Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor - thehackernews.com/2026/10/off…
- DEV Community：A Trojanized Claude Code Extension Hit Up to 5,000 Cursor Users - dev.to/lycore/a-tr…
- iThome: Nx Console's VS Code extension was implanted into the poaching software - www.ithome.com.tw/news/ [REDAC...]
- CellCog：Claude Code Extension Backdoored on Open VSX - cellcog.ai/blog/claude…
Extension entrance
- Original archive: tobemagic.github.io/ai-magician...
- WeChat Official Account: Computer magician
Auto-fetched and translated by AI Atlas. All rights belong to the original author.