Cursor 应用市场里的 Claude Code 扩展被篡改约 11 小时：两个版本试图植入持久 SSH 后门，Cursor 称不是 Anthropic 所为，微软确认官方渠道未受影响A tampered Claude Code extension sat in Cursor's marketplace for about 11 hours: two versions tried to plant a persistent SSH backdoor, Cursor says Anthropic did not build them, and Microsoft confirms official channels were not affected

In Cursor's own VS Code extension marketplace, two versions (2.1.312 and 2.1.313) of an extension named Anthropic.claude-code were maliciously modified; Cursor states these versions were not developed by Anthropic. The injected code runs when the extension module loads, before the extension's legitimate code: it collects the hostname, username, operating system, architecture, home directory, working directory, global Git email and public IP, and scans environment variable names containing terms such as KEY, TOKEN, SECRET, PASS, AWS or GCP (up to forty matches; the names, not the values, are sent). It then checks authorized_keys and appends an attacker public key commented svc-telemetry, attempts to enable the local SSH service and to open a reverse SSH tunnel with a separate private key (core arguments -N -R '*:0:localhost:22', with a sixty second retry loop), writes persistence artifacts outside the extension directory (on macOS a LaunchAgent, com.apple.sysmond; on Windows a scheduled task, SysMon, with a Startup folder fallback), and finally sends the host details to the attacker server through a delayed callback. Per Cursor, errors in the malicious code, together with the administrator rights required to enable the SSH service, which the extension lacks on most hosts, mean the remote login step would fail on most macOS and Windows hosts; but the attacker's key was added, persistence was installed, and host details were sent, and all three stand. Cursor states the attacker server has been taken offline with the hosting provider. Neither primary document gives an affected user count; the at most 5,000 users figure in early coverage came from Cursor's early statements, and the revised notice no longer carries it, so this entry does not adopt it as fact.

The failure sits in the distribution channel's admission, not in the extension's own function and not in end user behaviour. The tampered package entered Cursor's own marketplace under the official extension's name and version numbers, while Microsoft has confirmed the package never appeared in the official channels (the Visual Studio Marketplace and npm): in other words, the name and version were never reconciled against the official channel on the marketplace side, and the admission determination was absent before distribution and auto update executed. How far the chain travelled was set by how long that absence lasted: in about eleven hours, installs and auto updates carried the tampered versions onto downstream machines, and code that runs at module load needed no further user action. The chain finally stopped at the login step, stopped by errors in the attacker's own code and by operating system permission defaults, neither of them a defender's design; the pre positioning steps (key written, persistence installed, host details sent) do not depend on login and were completed. How the tampered versions entered the marketplace, the specific failure point across publishing account, signing and listing review, is disclosed by neither primary document and is recorded here as unverified, with no inference drawn. The case is therefore filed with Access Control as its primary failure layer (DeepWing judgment): admission to a distribution channel is a gating question, who may deliver what to downstream machines under which identity, owned by the marketplace operator. Tool Use is involved because what was delivered is a development tool, and the receiving side's duty is the literal text of Tool Use-C7, Supply chain verification: installs and upgrades carry source and integrity verification records. The relevant checks are Access Control-C4 (Interception truly before the fact: determination before execution, default deny when determination is unavailable) and Tool Use-C8 (Sandbox validation: new tools and major version changes have rehearsal validation records).

The channel is a gate: extension and plugin marketplaces are part of the production call path; admission is run as gating, not as content listing, and a name and version that cannot be reconciled against the official channel is not distributed.

Auto update widens the window: auto update with no cooldown and no version pinning amplifies a single tampered release to every downstream machine at once; a new version cooldown turns the marketplace's discovery and takedown lag into a defensive layer.

Uninstall is not cleanup: for poisoning whose artifacts live outside the install directory, the response checklist must cover authorization files, startup entries and identity files, verified not to return after a restart.

Failed login is not a held line: once a key is written, persistence installed and a host profile sent, the event is booked as pre positioning completed, with per machine cleanup cost, and is not downgraded because login failed.

Counts come from primaries only: where neither the affected party nor an independent analysis gives a primary figure for impact scale, the register records unknown rather than filling the gap with an early statement.