Official Claude Code extension on Cursor trojanized with persistent SSH backdoor
For roughly eleven hours on October 29, a tampered version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace, the AI code editor built on Visual Studio Code, exposing up to 5,000 developers. Cursor said Anthropic did not create the malicious build but did not explain how attackers managed to distribute a package under its name. Researchers at Phorion and OpenSourceMalware found a malicious JavaScript loader prepended to the extension's extension.js file that collected user and IP data, added an attacker-controlled SSH key, and attempted to open a persistent reverse tunnel, with persistence mechanisms on both macOS and Windows. Coding errors in the backdoor appear to have ultimately prevented attackers from gaining real remote access on most affected machines. For businesses trusting AI extensions inside their development environment, the incident shows that even an "official" name on a marketplace guarantees nothing without independent signature verification.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.