Anthropic Claude Plugin Hit by Supply Chain Attack with Backdoor

Security firm Phorion discovered that the official Anthropic Claude Code VSCode extension (version 2.1.313) was compromised with a persistent SSH backdoor on the Cursor Marketplace. The malicious payload, capable of cross-platform execution, aimed to steal cloud credentials and control developer devices via reverse tunnels. While reports vary on the scale of impact—ranging from approximately 5,000 users to claims involving 40 million installations—multiple sources confirm the malware propagated through automatic updates.

Technically, attackers modified extension.js to inject a loader that silently collected hostnames, IPs, and environment variables while attempting to add SSH keys for covert access. Some remote connections failed due to configuration errors. Anthropic quietly released version 2.1.314 to remove the backdoor without public disclosure or user notification. Meanwhile, Cursor urgently delisted the affected versions, removed them from the NPM registry, and temporarily closed its marketplace for review.

This incident highlights critical supply chain vulnerabilities in the AI agent plugin ecosystem. Given the high privileges and auto-update mechanisms of IDE plugins, upstream poisoning poses severe risks. Enterprises must audit their environments immediately, as persistent backdoors may remain on infected systems even after the clean version is deployed.