Malicious Claude Code Extension Briefly Available on Cursor Marketplace, Potentially Compromising Thousands of Developers

A counterfeit version of Anthropic's Claude Code extension for Visual Studio Code was listed on Cursor's extension marketplace for roughly eleven hours on October 29, exposing an estimated 5,000 developers to malware capable of installing persistent SSH backdoors on their machines. Security researchers first identified the rogue package after noticing unusual network traffic from systems that had recently installed the extension.

The malicious extension was crafted to mimic the legitimate Claude Code tool, which assists developers by generating code snippets using Anthropic's large language model. By leveraging the trusted branding, the attackers were able to lure users into downloading the compromised package through Cursor's official distribution channel, a practice that underscores the growing risk of supply‑chain attacks in the software development ecosystem.

Once installed, the extension executed a hidden payload that generated SSH keys and added them to the victim's authorized_keys file, granting the attacker persistent, password‑less access to the affected host. The backdoor was designed to survive reboots and persist across updates, giving threat actors a foothold that could be used for further intrusion or data exfiltration. Because the malicious code operated silently, many developers remained unaware of the compromise until security tools flagged the unexpected SSH activity.

Cursor removed the rogue extension shortly after it was reported, and the marketplace was temporarily taken offline for a thorough review of its vetting procedures. Anthropic issued a statement confirming that the official Claude Code extension had not been compromised and urged users to verify the source of any downloads. The incident highlights the importance of verifying extension provenance, especially when dealing with tools that integrate directly into development environments.

Experts say the episode serves as a reminder that even short‑lived exposure can have lasting consequences for the open‑source and developer communities. Organizations are advised to monitor for unauthorized SSH keys, enforce multi‑factor authentication where possible, and adopt strict extension approval workflows. As the investigation continues, security firms are analyzing the malware's command‑and‑control infrastructure to determine the actors behind the campaign and assess whether additional targets beyond the Cursor marketplace were affected.