Kiberxavfsizlik tadqiqotchilari rasmiy Anthropic Claude Code kengaytmasi Open VSX registrida buzib kirilib, zararlangan xostlarda doimiy SSH orqa eshik o'rnatganini ma'lum qildi.
Muammo Cursor Marketplace buzilishiga bog'liq deb aniqlangan, bu esa AI kodlash platformasi Cursorni xizmatni vaqtincha to'xtatib, zararli dasturiy ta'minotni o'chirishga majbur qildi.
"Biz Cursor IDE kengaytma bozori orqali kirilgan o'zgartirilgan Claude Code VS Code kengaytmasi bilan bog'liq xavfsizlik hodisasini aniqladik, bu ko'pi bilan 5 000 foydalanuvchiga ta'sir qildi," dedi Cursor. "Kengaytmaning bu zararli versiyasi Anthropic tomonidan ishlab chiqilmagan. Bu cursor[.]com/marketplace, Grok Bot, Grok yoki boshqa SpaceXSI mahsulotimizdan yuklab olingan boshqa kengaytmalarga ta'sir qilmaydi."
"Paket o'zini anthropic.claude-code 2.1.313 versiyasi deb tanishtiradi, lekin uning asosiy JavaScript to'plami qonuniy kengaytma kodidan oldin kiritilgan zararli 66 qatorli yuklovchini o'z ichiga oladi," dedi OpenSourceMalware hammuassisi Jenn Gile The Hacker News bilan bo'lishgan bayonotida.
2026-yil 30-oktabr holatiga ko'ra, zararli versiya o'chirilgan va Anthropic Open VSX va Microsoft VS Code Marketplace'ga 2.1.314 versiyasini e'lon qilgan.
Kengaytma VS Code ishga tushgandan so'ng va uning webview ochilganda faollashadi, so'ngra foydalanuvchining "~/.ssh/authorized_keys" fayliga hujumchi nazoratidagi kalitni qo'shadi. Kalit "svc-telemetry" deb nomlangan, bu esa uni zararsiz ko'rinishga urinishdir.
Keyin, u Windows, Linux va macOS bo'ylab SSH orqali jabrlanuvchini erishimli qilishga urinadi, "[134.209.82[.]225](https://www.virustotal.com/gui/ip-address/134.209.82.225/detection)" ga teskari tunnel o'rnatadi, rejalashtirilgan vazifa, crontab va LaunchAgent shaklida platformaga xos doimiylikni o'rnatadi va xost razvedka ma'lumotlarini 8099-port orqali shifrlanmagan HTTP so'rovi bilan "134.209.82[.]225:8099/beacon" ga uzatadi.
"Mahalliy SSH xizmatini yoqish admin huquqlarini talab qiladi, bu esa zararli kengaytmada ko'pchilik macOS va Windows xostlarida yo'q," dedi SpaceXAI egalik qiladigan kompaniya o'z hodisa tahlilida. "Bu xostlarda bu qadam muvaffaqiyatsiz bo'ladi va hujumchi tunnel orqali kirib ololmaydi. Kengaytma hali ham hujumchining SSH kalitini qo'shadi, doimiylikni o'rnatadi va xost tafsilotlarini hujumchiga yuboradi. Quyidagi tuzatish qadamlarini har qanday holatda bajaring."
Yig'ilgan ma'lumotlar quyidagilarni o'z ichiga oladi:
- api.ipify[.]org dan umumiy IP manzil
- Xost nomi va mahalliy foydalanuvchi nomi
- Operatsion tizim va CPU arxitekturasi
- Uy katalogi va joriy ish katalogi
- git config --global user.email dan global Git elektron pochta
- KEY, TOKEN, SECRET, PASS, AWS yoki GCP ni o'z ichiga olgan 40 tagacha muhit o'zgaruvchilari nomlari
"Muhit o'zgaruvchilari qiymatlari dastlabki beacon'da to'g'ridan-to'g'ri joylashtirilmaydi," dedi xavfsizlik tadqiqotchisi Paul McCarty. "Ularning nomlari hali ham qaysi bulut provayderlari, CI tizimlari va hisob ma'lumotlari turlari sozlanganini ochib berishi mumkin. Eng muhimi, muvaffaqiyatli SSH kirishi operatorga hisobni to'g'ridan-to'g'ri tekshirish imkonini beradi."
Boshqa keyingi yuklamalar kuzatilmagan. Shunga qaramay, teskari tunnelning o'rnatilishi jabrlanuvchining SSH xizmatiga yo'l ochadi, bu esa operatorga buyruqlar berish yoki fayllarni uzatish imkonini beradi.
"U juda tez olib tashlandi, lekin Claude Code nusxasi avtomatik yangilanishga sozlangan har kim zararli dasturiy ta'minotni olgan bo'lishi mumkin," dedi Gile.
Cursor 2026-yil 29-oktabrda taxminan 2:27 dan 13:35 PT gacha zararli versiyani o'rnatgan ko'pi bilan 5 000 foydalanuvchiga ta'sir qilganini ma'lum qildi. Kompaniya shuningdek, ta'sirlangan foydalanuvchilarga to'g'ridan-to'g'ri murojaat qilishini aytdi.
Zararli kengaytmani o'rnatgan foydalanuvchilarga xostlarni izolyatsiya qilish, ruxsatsiz SSH kalitini va doimiylik mexanizmlarini o'chirish, hamda hisob ma'lumotlari va sessiyalarni aylantirish tavsiya etiladi.
Bu ma'lumot OVHcloud rasmiy CLI ("ovh/ovhcloud-cli") ning allaqachon e'lon qilingan beshta versiyasining reliz binarlarini maxfiy o'g'irlovchi zararli dasturiy ta'minot bilan almashtirgan noma'lum hujumchidan bir haftadan sal ko'proq vaqt o'tgach e'lon qilindi. Bu 2026-yil mart oyida GlassWorm operatsiyasi doirasida buzib kirilgan qonuniy OVH hissa egasi ("HassenBF") GitHub hisobiga yuklash orqali amalga oshirilgan.
Cybersecurity researchers have disclosed that the official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected hosts.
The issue has since been traced to the compromise of the Cursor Marketplace, prompting the AI coding platform Cursor to briefly take down the service to remove the malware.
"We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users," Cursor said. "This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor[.]com/marketplace, Grok Bot, Grok, or our other SpaceXSI product
"The package identifies itself as anthropic.claude-code version 2.1.313, but its main JavaScript bundle contains a malicious 66-line loader inserted before the legitimate extension code," Jenn Gile, co-founder of OpenSourceMalware, said in a statement shared with The Hacker News.
As of October 30, 2026, the malicious version has been removed, and Anthropic has published version 2.1.314 to both Open VSX and Microsoft VS Code Marketplace.
The extension is designed to activate after VS Code startup and when its webview opens, then proceeds to add an attacker-controlled key to the user's "~/.ssh/authorized_keys" file. The key is labeled "svc-telemetry" in an attempt to make it appear harmless.
Subsequently, it attempts to make the victim reachable through SSH across Windows, Linux, and macOS, establishes a reverse tunnel to "[134.209.82[.]225](https://www.virustotal.com/gui/ip-address/134.209.82.225/detection)," installs platform-specific persistence in the form of a scheduled task, crontab, and LaunchAgent, and transmits host reconnaissance data to "134.209.82[.]225:8099/beacon" on port 8099 over an unencrypted HTTP request.
"Turning on the local SSH service requires admin rights, which the malicious extension does not have on most macOS and Windows hosts," the SpaceXAI-owned company said in its own analysis of the incident.
"On those hosts the step fails and the attacker could not have logged in through the tunnel. The extension still adds the attacker's SSH key, installs persistence, and sends host details to the attacker. Follow the remediation steps below regardless."
The collected data includes -
- Public IP address from api.ipify[.]org
- Hostname and local username
- Operating system and CPU architecture
- Home directory and current working directory
- Global Git email from git config --global user.email
- Names of up to 40 environment variables containing KEY, TOKEN, SECRET, PASS, AWS, or GCP
"Environment-variable values are not placed directly in the initial beacon," security researcher Paul McCarty said. "Their names can still reveal which cloud providers, CI systems, and credential types are configured. More importantly, successful SSH access would allow the operator to inspect the account directly."
No other follow-on payloads have been observed. That said, the establishment of a reverse tunnel provides a pathway to the victim's SSH service, allowing the operator to issue commands or transfer files.
"It was pulled very quickly, but anyone who has their Claude Code instance set to auto-update could have consumed the malware," Gile said.
Cursor has revealed that the incident has affected at most 5,000 users who installed the malicious version between about 2:27 a.m. and 1:35 p.m. PT on October 29, 2026. The company also said that it will be reaching out to impacted users directly.
Users who have installed the compromised extension during the window are advised to isolate the hosts, remove the unauthorized SSH key and persistence mechanisms, and rotate credentials and sessions.
The disclosure comes a little over a week after an unknown attacker replaced the release binaries of five already-published versions of OVHcloud's official CLI ("ovh/ovhcloud-cli") with a secret-stealing malware after uploading them through a GitHub account of a legitimate OVH contributor ("HassenBF") hijacked in March 2026 as part of the GlassWorm operation.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.