Cursor Marketplace'dagi Zararli Claude Code Kengaytmalari Windows va macOS'da Doimiy SSH Orqa Eshiklarini O'rnatadi

Cursor'ning VS Code kengaytma bozorida tarqatilgan zararli Claude Code kengaytmalari Windows va macOS dasturchi tizimlarida doimiy SSH orqa eshiklarini yaratishga urindi.

Ta'sirlangan paketlar Anthropic.claude-code 2.1.312 va 2.1.313 versiyalari bo'lib, ular 2026-yil 29-oktabrda taxminan 2:27 dan 13:35 gacha mavjud edi.

Cursor Anthropic bu o'zgartirilgan paketlarni ishlab chiqmaganini ma'lum qildi. Kengaytma bozori Windows va macOS dasturchi tizimlarida doimiy SSH orqa eshiklarini o'rnatishga urindi.

Ta'sirlangan paketlar, Anthropic.claude-code 2.1.312 va 2.1.313 versiyalari, 2026-yil 29-oktabrda taxminan 2:27 dan 13:35 gacha Tinch okeani vaqti bilan mavjud edi. Cursor Anthropic bu o'zgartirilgan paketlarni ishlab chiqmaganini aytdi.

Cursor'ning 30-oktabrda yangilangan xavfsizlik xabariga ko'ra, tergovchilar boshqa kengaytma versiyalari yoki rasmiy tarqatish ta'sirlanganiga dalil topmadilar.

Bu hodisa zararli dasturchi kengaytmalari ishonchli kodlash muhitini ruxsatsiz kirish nuqtasiga aylantirishi mumkinligini ko'rsatadi. Biroq, muhim imtiyoz cheklovlari bu yuklamaning samaradorligini chekladi.

O'zgartirilgan extension.js xost nomlari, foydalanuvchi nomlari, operatsion tizimlar, protsessor arxitekturalari, uy katalog yo'llari, ish kataloglari, sozlangan Git elektron pochta manzillari va ommaviy IP manzillarini to'pladi.

Shuningdek, u muhit o'zgaruvchilari nomlarini ham yig'di. Cursor tavsifida dastlabki yig'ish muhit o'zgaruvchilari qiymatlarini o'z ichiga olganligi aniqlanmagan; bu farq potentsial ma'lumotlar fosh bo'lishini baholashda muhim.

Yuklama svc-telemetry izohi bilan aniqlangan hujumchi nazoratidagi SSH ochiq kalitini SSH avtorizatsiya fayllariga qo'shishga urindi.

Keyin u mahalliy SSH xizmatini yoqishga va 134[.]209[.]82[.]225 ga TCP 22-porti orqali teskari tunnel o'rnatishga urindi. Hujumchi xost razvedkasini 8099-portidagi beacon nuqtasiga HTTP POST so'rovlari orqali uzatdi.

Tunnel buyrug'i ssh -N -R '*:0:localhost:22' ni o'z ichiga oldi, bog'liq variantlar esa xost kalit tekshiruvini o'chirdi va ulanishni saqlash sozlamalarini o'rnatdi. Fon skriptlari tunnelni taxminan har 60 soniyada qayta urinishdi.

Bu qonuniy masofaviy kirish vositalaridan foydalanish maxsus masofaviy boshqaruv zararli dasturiga tayanmasdan doimiylikni o'rnatadigan SSH asosidagi orqa eshik texnikalariga o'xshaydi.

macOS'da doimiylik ~/Library/LaunchAgents/com.apple.sysmond.plist LaunchAgent yordamida, qo'llab-quvvatlovchi fayllar esa ~/.config/ ostida amalga oshirildi. Windows'da zararli dastur SysMon nomli rejalashtirilgan vazifani SYSTEM sifatida yaratishga urindi, Startup papkasidagi skript esa zaxira sifatida ishlatildi. Bu alohida artefaktlar zararli kengaytma o'chirilgandan keyin ham saqlanib qolishi mumkin.

Biroq, Cursor SSH'ni yoqish kengaytma odatda ega bo'lmagan administrator imtiyozlarini talab qilishini ta'kidladi. Kodlash xatolari ham g'ayrioddiy yuqori darajadagi bajarilish holatlaridan tashqari muvaffaqiyatli orqa eshik o'rnatilishini chekladi.

Shunga qaramay, kompaniya ruxsatsiz kalit kiritilishi, doimiylik o'rnatilishi va xost ma'lumotlari uzatilishini xabar qildi, bu esa masofaviy kirish muvaffaqiyatsiz bo'lsa ham tozalashni zarur qiladi. Kengroq xavf dasturchi ma'lumotlariga kengaytma kirishi haqidagi xavotirlarni to'ldiradi, lekin bu hodisa o'sha alohida zaiflikdan foydalanilganini ko'rsatmaydi.

Cursor paketlarni o'chirdi, bozorni vaqtincha yopdi, kirishni tekshirdi, kalitlarni aylantirdi, xizmatni qayta qurdi va mavjudlikni tikladi. Shuningdek, u hujumchining serverini o'chirish uchun xosting provayderi bilan ishladi, bu esa tunnel va tashqi beacon'larni buzdi.

Ta'sirlangan tashkilotlar kengaytma o'rnatish yozuvlarini, endpoint hodisalarini va tarmoq telemetriyasini tekshirishlari, bajarilish dalillarini ko'rsatadigan mashinalarni izolyatsiya qilishlari va ruxsatsiz kalitlar, doimiylik fayllari va tunnel jarayonlarini o'chirishlari kerak.

Cursor tizimlarni qayta qurish zarurligini baholash va ishonchli mashinadan foydalanib mumkin bo'lgan ma'lumotlar va sessiyalarni aylantirishni tavsiya qiladi. Uning platformaga xos tozalash skriptlari kengaytma va alohida artefaktlarni o'chiradi; faqat o'chirish yetarli emas.

IoC

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat nazorat qilinadigan tahdid razvedkasi platformalarida, masalan MISP, VirusTotal yoki SIEM'da qayta fangalang.

SOC'ingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering.16K SOC'dan tahdid razvedkasini integratsiya qiling.

Malicious Claude Code extensions distributed through Cursor’s VS Code The Extension Marketplace tried to create persistent SSH backdoors on Windows and macOS developer systems.

The affected packages were the Anthropic.claude-code versions 2.1.312 and 2.1.313, which were available on October 29, 2026, between approximately 2:27 a.m. and 1:35 p.m.

Cursor stated that Anthropic did not develop these modified packages. Extension Marketplace attempted to establish persistent SSH backdoors on Windows and macOS developer systems.

The affected packages, Anthropic.claude-code versions 2.1.312 and 2.1.313, were available on October 29, 2026, between approximately 2:27 a.m. and 1:35 p.m. Pacific Time. Cursor said Anthropic did not develop these modified packages.

According to Cursor’s security notice, updated October 30, investigators found no evidence that other extension versions or the official distribution were affected.

The incident illustrates how malicious developer extensions can turn a trusted coding environment into an entry point for unauthorized access. However, important privilege restrictions limited this payload’s effectiveness.

The modified extension.js collected hostnames, usernames, operating systems, processor architectures, home directory paths, working directories, configured Git email addresses, and public IP addresses.

It also gathered environment variable names. Cursor’s description does not establish that the initial collection included environment variable values, a distinction relevant when assessing potential credential exposure.

The payload attempted to append an attacker-controlled SSH public key, identified by the comment svc-telemetry, to SSH authorization files.

It then tried to enable the local SSH service and establish a reverse tunnel to 134[.]209[.]82[.]225 over TCP port 22. HThe attackertransmitted thost reconnaissance hrough HTTP POST requests to the beacon endpoint on port 8099.

The tunneling command included ssh -N -R ‘*:0:localhost:22’, while associated options disabled host-key verification and configured connection keepalives. Background scripts retried the tunnel approximately every 60 seconds.

This use of legitimate remote-access tooling parallels SSH-based backdoor techniques that establish persistence without relying exclusively on custom remote-control malware.

On macOS, persistence used a LaunchAgent at ~/Library/LaunchAgents/com.apple.sysmond.plist, with supporting files under ~/.config/. On Windows, the malware attempted to create a scheduled task named SysMon running as SYSTEM, with a Startup-folder script as a fallback. These standalone artifacts could survive removal of the malicious extension itself.

However, Cursor emphasized that enabling SSH required administrator privileges that the extension generally lacked. Coding errors also restricted successful backdoor establishment outside unusual elevated execution scenarios.

The company nevertheless reported unauthorized key insertion, persistence installation, and host-information transmission, making remediation necessary even where remote login failed. The broader risk complements concerns about extension access to developer credentials, but it does not show that this incident exploited that separate weakness.

Cursor removed the packages, temporarily shut down the marketplace, audited access, rotated keys, rebuilt the service, and restored availability. It also worked with the hosting provider to disable the attacker’s server, disrupting both tunneling and external beacons.

Affected organizations should investigate extension-installation records, endpoint events, and network telemetry, isolate machines showing execution evidence, and remove unauthorized keys, persistence files, and tunnel processes.

Cursor recommends assessing whether systems require rebuilding and rotating accessible credentials and sessions from a trusted machine. Its platform-specific cleanup scripts remove the extension and standalone artifacts; uninstalling alone is insufficient.

IoC

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.