Malicious Cursor Extensions Deploy SSH Backdoor on Windows and macOS Development Environments

Security researchers have uncovered a series of compromised extensions for the Claude Code platform that silently harvest system information and install persistent SSH backdoors on developers' machines. The malicious packages, distributed through Cursor's extension marketplace, target both Windows and macOS users, embedding code that creates hidden files and opens a remote access channel without the user's knowledge.

The investigation, first reported by Hackread, shows that the extensions collect detailed device identifiers—such as OS version, hardware specs, and network configuration—before writing covert scripts to the file system. These scripts establish an SSH tunnel that can be re‑activated at any time, giving an attacker ongoing entry to the compromised host even after a reboot.

Cursor, a popular AI‑assisted coding assistant, allows third‑party developers to publish add‑ons that extend its functionality. While the platform promotes rapid integration of new tools, the incident highlights the inherent risk of a decentralized extension ecosystem where code is often reviewed only superficially. In this case, the malicious payload was hidden within seemingly benign functionality, evading detection by both the marketplace's automated scanners and end‑users.

Experts note that the technique mirrors broader supply‑chain threats that have plagued software development in recent years, where attackers compromise trusted distribution channels to reach a large audience. By focusing on developers, the perpetrators gain access to environments that often contain proprietary source code, API keys, and other sensitive assets, potentially amplifying the impact of any subsequent breach.

Cursor's response team has issued a statement acknowledging the issue and pledging to remove the offending extensions immediately. They also announced plans to tighten vetting procedures, introduce stricter code signing requirements, and enhance monitoring for anomalous activity within the extension marketplace. Users are advised to review installed extensions, revoke any unknown SSH keys, and run reputable anti‑malware tools to detect lingering artifacts.

The episode serves as a reminder for developers to exercise caution when adopting third‑party tools, especially those that integrate deeply with development workflows. Regularly auditing installed plugins, limiting privileged access, and staying informed about emerging threats are essential steps to safeguard both personal workstations and the broader software supply chain.