#3
BleepingComputer
general
October 30, 2026 at 14:36 UTC
Malicious Claude Code extension on Cursor planted SSH backdoors
By Bill Toulas
AI Summary
A trojanized version of Anthropic's official Claude Code VS Code extension was distributed via Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware that installed persistent SSH backdoors on infected hosts. The attack vector was a compromise of Cursor's marketplace itself, not the extension's source code, raising serious supply chain concerns for AI-assisted development environments. Cursor temporarily took down its marketplace service to remove the malicious package.
Relevance score: 91.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →