Cursor Marketplace Distributes Trojanized Claude Code Extension with Persistent SSH Backdoor
Original headline: Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Security researchers reported that a trojanized version of Anthropic’s official Claude Code extension (v2.1.313) was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update was signed under the extension’s legitimate publisher identity, prompting Cursor to temporarily suspend the marketplace.
The supply‑chain attack exposes thousands of development environments to persistent remote access threats.
Research angleHow does awareness of supply‑chain attacks influence developers’ intention to verify security updates? — Protection Motivation Theory
4 related reports
- Anthropic: That Claude Code extension compromise… couldn't be us — The Register
- Devs Hit by Trojanized Claude Code Extension for Cursor — Dark Reading
- A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices — WIRED
- Anthropic VS code extension on Cursor backdoored for nearly 12 hours — Ars Technica
Turn this security issue into a research project
HJITM works with researchers from study design through surveys, analysis and submission to international journals in generative AI and technology management. Bring us your research question.
This item is an AI-generated summary of reporting by The Hacker News. Please check the original article for accuracy. Copyright in the original article belongs to The Hacker News.