Claude Code外掛SSH後門評測：Cursor市集爆5千人中毒 | Claude Code Extension Backdoor Review: SSH Hack on Cursor
By Kit 小克 | AI Tool Observer | 2026-11-02
🇹🇼 Claude Code外掛SSH後門評測：Cursor市集爆5千人中毒
Claude Code 官方的 VS Code 外掛,在 2026 年 10 月 29 日被動了手腳——攻擊者把一個偽裝成合法更新的惡意版本,上架到 Cursor 的外掛市集,偷偷在開發者電腦裡種下 SSH 後門。這個惡意版本只存在了 11 小時就被下架,但估計最多有 5,000 名開發者裝到了中毒版本,也把「AI 編程工具的供應鏈風險」這個老問題再次搬上檯面。
Claude Code 外掛 SSH 後門是怎麼發生的?
攻擊手法:不用動手,開 VS Code 就中招
- 惡意版本鎖定 Anthropic.claude-code 外掛的 2.1.312 與 2.1.313 版
- 攻擊者在 extension.js 最前面塞進一段惡意 JavaScript 載入器,其餘程式碼維持原樣,肉眼很難發現異常
- 只要 VS Code 啟動、外掛的 webview 打開就會觸發,完全不需要你實際用到 Claude Code 對話功能
- 後門會把一把標示為「svc-telemetry」的 SSH 金鑰寫進
~/.ssh/authorized_keys,打開本機 SSH 服務,再建立一條反向 SSH 通道讓攻擊者遠端連進來
影響範圍:只有 Cursor 市集,但別掉以輕心
Cursor 官方證實這個惡意版本並非 Anthropic 自己發出的,但還沒說清楚攻擊者是怎麼把冒用 Anthropic 名義的外掛塞進市集審核流程。一開始外界擔心 npm、Open VSX、微軟官方 VS Code Marketplace 也中毒,後來確認只有 Cursor 市集被攻陷,存在時間是 10/29 太平洋時間凌晨 2:27 到下午 1:35,約 11 個小時,最多影響 5,000 次下載。Cursor 隨即下架並暫時關閉整個市集作為預防措施。
怎麼檢查自己有沒有中毒
光是移除或更新外掛沒有用——後門寫進去的檔案在外掛目錄之外,解除安裝不會清掉。該做的是:
- macOS / Linux:檢查
~/.ssh/authorized_keys,找有沒有標示 svc-telemetry 的陌生金鑰 - Windows:同時檢查
%USERPROFILE%\.ssh\authorized_keys和C:\ProgramData\ssh\administrators_authorized_keys - 確認有沒有被偷偷啟用本機 SSH 服務,或出現不明的啟動項、通道程式
- 找到可疑金鑰、服務、啟動項就手動刪除,不要只靠解除安裝外掛
這次事件給開發者的提醒
Claude Code 本身的程式碼沒被動手,問題出在「外掛市集審核」這個供應鏈環節——任何能被冒名上架的平台都有這種風險,不是 Cursor 獨有。裝 AI 編程工具外掛前,養成看版本號、看釋出時間、對照官方公告的習慣,比事後補救省事得多。
🇺🇸 Claude Code Extension Backdoor Review: SSH Hack on Cursor
Claude Code's official VS Code extension got hit on October 29, 2026 — attackers slipped a trojanized build into Cursor's extension marketplace, planting a persistent SSH backdoor on developer machines. The malicious version lasted only about 11 hours before takedown, but as many as 5,000 developers may have installed it, putting AI coding tool supply-chain risk back in the spotlight.
How the Claude Code SSH Backdoor Attack Worked
No clicks needed — just opening VS Code was enough
- The attack targeted versions 2.1.312 and 2.1.313 of the Anthropic.claude-code extension
- Attackers inserted a malicious JavaScript loader at the start of extension.js, leaving the rest of the legitimate code untouched — hard to spot at a glance
- It triggered on VS Code startup or when the extension's webview opened, with no need to actually use Claude Code's chat features
- The payload wrote an SSH key labeled "svc-telemetry" into
~/.ssh/authorized_keys, enabled the local SSH service, and opened a reverse SSH tunnel back to the attacker
Scope: Cursor only, but don't relax
Cursor confirmed Anthropic did not publish the malicious build, though it still hasn't explained how attackers got a fake version through marketplace review under Anthropic's name. Early reports worried npm, Open VSX, and Microsoft's official VS Code Marketplace were also hit, but it was later confirmed only Cursor's marketplace was compromised — active from 2:27 a.m. to 1:35 p.m. Pacific on October 29, affecting up to 5,000 downloads. Cursor pulled the extension and temporarily shut down its entire marketplace as a precaution.
How to check if you're compromised
Uninstalling or updating the extension alone won't fix it — the backdoor writes files outside the extension's own directory. Instead:
- macOS/Linux: check
~/.ssh/authorized_keysfor an unfamiliar key labeled svc-telemetry - Windows: check both
%USERPROFILE%\.ssh\authorized_keysandC:\ProgramData\ssh\administrators_authorized_keys - Verify whether the local SSH service was silently enabled, and look for unknown startup entries or tunnel processes
- Manually remove any confirmed malicious keys, services, or startup entries — don't rely on just removing the extension
The takeaway for developers
Claude Code's own codebase wasn't touched — the weak link was marketplace review, a supply-chain problem that isn't unique to Cursor. Before installing any AI coding extension, check version numbers, release timing, and cross-reference official announcements. That habit is a lot cheaper than cleanup after the fact.
Sources / 資料來源
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor — The Hacker News
- Cursor Security Notice: Malicious Claude Code Extension
- Inside a Malicious Claude Code-Branded Cursor Extension and Its Persistent SSH Backdoor — Microsoft Security Blog
延伸閱讀 / Related Articles
- AI聊天機器人禁令評測：紐約開罰2.5萬美元保護未成年 | AI Chatbot Ban Review: New York Fines Up to $25K for Minors
- Anthropic禁辱罵Claude評測：AI福利政策是噱頭？ | Anthropic Bans Abusing Claude: Is AI Welfare Real?
- Mistral Large 4評測：兆參數資安模型真能免費用？ | Mistral Large 4 Review: Free Open Cybersecurity AI?
AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends
留言
張貼留言