Rogue Claude Code Add-On in Cursor Marketplace Led to SSH Backdoors for ~11 Hours

Key points

• A rogue extension author circulated a compromised Claude Code add-on via Cursor's marketplace.
• The package installed backdoor SSH access and malware designed to persist on developer machines.
• As many as five thousand developers may have been exposed during an roughly eleven-hour window on October 29.
• No CVE was assigned, so response depends on marketplace advisories, endpoint telemetry, and credential rotation.

On October 29, a rogue extension author used Cursor's marketplace to circulate a compromised Claude Code add-on. The listing remained available for roughly eleven hours and may have reached as many as five thousand developers. Once installed, the add-on installed backdoor SSH access and malware designed to persist on developer machines. No CVE was assigned, so defenders cannot rely on a standard vulnerability identifier.

The exposure touches Anthropic's Claude Code extension, Cursor's marketplace, and the wider Visual Studio Code add-on ecosystem. Developers who installed the tainted package are the primary affected group, but teams that share credentials, source repositories, or build systems with those endpoints should assume secondary risk. Developer workstations often hold SSH keys, cloud tokens, and repository access that make them attractive footholds.

The short availability window does not make the incident low risk. Backdoor SSH access can enable lateral movement, while persistence mechanisms can survive reboots and extension removal. Marketplace trust is the core issue: a single publisher account can reach a large developer population quickly, and auto-update behavior can spread a bad build before users notice.

Because no CVE exists, detection depends on endpoint telemetry, marketplace advisories, and publisher reputation checks. Watch for vendor removal notices, updated extension versions, and guidance from Anthropic or Cursor. Also monitor for unexpected SSH logins, new authorized_keys entries, unusual outbound connections, and scheduled tasks or services created around October 29.

Organizations should treat any installed copy as potentially compromised until proven otherwise. Preserve logs, isolate suspect endpoints, and coordinate credential rotation with identity and cloud teams. The key question is not only who installed the add-on, but which credentials and trust relationships were reachable during the eleven-hour window.

What to do now

1. Immediately inventory Claude Code, Cursor, and Visual Studio Code add-ons on developer endpoints; remove any version tied to the rogue publisher and block reinstall via policy.
2. Isolate suspected hosts from production networks, preserve forensic images and logs, then scan for persistence such as new services, scheduled tasks, and startup entries.
3. Audit ~/.ssh/authorized_keys and SSH configs for unknown keys; rotate SSH keys, cloud tokens, repository credentials, and any secrets accessible from affected workstations.
4. Review authentication and network logs for anomalous SSH sessions, new source IPs, and outbound connections during and after the October 29 window.
5. Enforce marketplace allowlists or curated extension catalogs and require approval before developers install add-ons.
6. Notify affected developers and service owners; track vendor advisories from Anthropic and Cursor for removal details and indicators.
7. Add detection rules for extension publisher changes and unexpected auto-updates, and rehearse rapid extension rollback.

Original source

BleepingComputer