Researcher identifies injected code
Security company Phorion reported on October 30 that it found malicious code inside version 2.1.313 of the Claude Code extension distributed through the Cursor Marketplace. The firm described the affected package as an official extension bundle and said the release was removed after the discovery. It also said matching NPM and VS Code releases were pulled from their registries.
The report says the injected JavaScript executes as the extension loads, before its ordinary activation routine. Because editor extensions run with the user’s permissions, that position could expose local source code, files and development tools without requiring a separate interaction after installation.
Phorion’s analysis says the payload creates or modifies the user’s SSH configuration, adding an attacker-controlled public key to the authorized keys file. It also attempts to establish persistence and launches an outbound SSH connection that can create a reverse tunnel back to the machine’s local SSH service. The researcher advised defenders to hunt by the embedded key fingerprint rather than relying only on the key’s comment text.
Implementation errors may limit access
The analysis found that parts of the malicious logic were unreliable. On macOS, a command used to check whether Remote Login is enabled requires administrator access. When run by an ordinary user, it returns an error message that the payload does not handle correctly. The malware can therefore skip the step intended to turn on SSH, leaving its inbound path unavailable when Remote Login was not already active.
Phorion also reported limitations on other platforms. Commands intended to start system services depend on passwordless administrative access, while a Windows path appears to invoke a Unix shell that may not exist. Those errors do not make the package harmless: the report says it still plants persistence material and sends host reconnaissance to infrastructure controlled by the operator. A machine with SSH already enabled could remain accessible through the tunnel.
Response guidance
Organizations should check whether developers installed version 2.1.313 and treat a match as an incident-response trigger, according to Phorion. Investigation should include the extension files, SSH authorized keys, temporary private-key files, outbound connections and persistence mechanisms. Removing the package alone may not remove changes already made to a user profile.
The technical findings currently come from Phorion’s advisory. The report identifies the package behavior and affected version but does not establish who inserted the code or how the marketplace release was compromised. Those attribution questions remain open pending statements or additional findings from the relevant vendors.
