Security researchers found that attackers had inserted a 66-line loader into the extension's JavaScript code. The added instructions attempted to configure remote access, establish persistence, and transmit information about affected systems.
The malware first gathered identifying details about the computer and its user, including the operating system, username, public IP address, working directories, and configured Git email. It also collected environment variable names that could reveal which development tools, cloud services, or credential types were configured.
Researchers noted that the initial data transmission did not directly include environment variable values. However, successful remote access could have allowed attackers to inspect additional information on a compromised machine.
The more serious component involved an attempted SSH backdoor. The extension tried to insert an attacker-controlled public key into the system's authorized SSH keys, activate the local SSH service, and establish a reverse connection to an external server.
To maintain that connection, the malware also installed background mechanisms designed to restart the tunnel approximately every 60 seconds. On macOS, it used a LaunchAgent, while the Windows implementation relied on a scheduled task with a Startup-folder fallback. Researchers also identified Linux-specific persistence behavior.
Cursor's investigation found that the attack's remote-access component would generally fail because of programming errors and insufficient system permissions.
“Outside of highly unusual circumstances where Cursor was started with administrator privileges, due to errors in the malicious code, this step would fail,” the company explained in its security notice.
Enabling SSH typically requires elevated permissions on macOS and Windows, which the extension would not ordinarily possess. As a result, the attacker would generally have been unable to establish the intended remote connection.
That limitation did not eliminate the security risk. The malicious extension could still install an unauthorized SSH key, create persistence mechanisms, and collect system details, leaving affected machines requiring inspection and cleanup.
The attack was also notable because it involved a modified version of a legitimate extension rather than a separately published imitation.
Researchers at OpenSourceMalware confirmed that the package retained Anthropic's official extension identifier while incorporating malicious code into its main JavaScript bundle. This allowed the compromised update to appear as part of the normal extension distribution process.
The incident was limited to Cursor's marketplace, according to the available investigation. There is no evidence that Anthropic's official distribution, Microsoft's VS Code Marketplace, or Open VSX distributed the malicious version.
Anthropic has since published version 2.1.314 through Microsoft and Open VSX.
After discovering the incident, Cursor removed the compromised extension and temporarily disabled its entire extension marketplace while investigating the breach.
The company audited marketplace access, determined that no additional extensions had been modified, rotated its security keys, and rebuilt the marketplace before restoring service.
Cursor also coordinated with the hosting provider responsible for the attacker's infrastructure to disable the server receiving system information and supporting the attempted SSH connections.
The company says the malicious server is no longer operational, preventing the original payload from communicating with that destination.
However, Cursor has not disclosed how the attackers managed to introduce the unauthorized update into its marketplace. The precise method used to compromise the distribution process remains unknown.
Cursor is contacting potentially affected users directly and has published remediation instructions for developers who installed or updated the extension during the identified period.
The company warns that simply uninstalling version 2.1.313 may not remove the malicious components. Because the extension created separate background scripts, those files could remain after the original package is deleted.
Affected users are advised to inspect their systems for the unauthorized SSH key, identify persistence mechanisms, and remove any related processes. Cursor has provided cleanup scripts for macOS and Windows, along with technical indicators that security teams can use to investigate affected endpoints.
The company also recommends isolating machines showing evidence of malicious code execution, evaluating whether a complete system rebuild is necessary, and rotating credentials or active sessions accessible from affected computers.
Although Cursor's findings suggest the attempted remote-access mechanism would fail under most normal configurations, the incident illustrates how a compromised extension update can introduce security risks into development environments.
The investigation has established the affected package, distribution window, and intended malicious behavior, but the method used to publish the unauthorized update remains unresolved. Cursor says no other marketplace extensions were compromised and that the attacker's infrastructure has been taken offline.
This analysis is based on reporting from Cursor & The Hacker News.
Image courtesy of The Hacker News.
This article was generated with AI assistance and reviewed for accuracy and quality.
