Trojanized Claude Code Extension Distributed via Cursor Marketplace with Persistent SSH Backdoor
Original headline: Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Security researchers reported that a trojanized version of Anthropic’s official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update. The malicious version 2.1.313 attempted to install a persistent SSH backdoor on victim systems. The update was signed under the legitimate publisher’s identity, prompting Cursor to temporarily suspend the marketplace.
The incident highlights the growing supply-chain risk of AI development tools.
Research angleHow do supply-chain attacks on AI plugins affect developers’ security compliance intentions? — Protection Motivation Theory
3 related reports
Turn this security issue into a research project
HJITM works with researchers from study design through surveys, analysis and submission to international journals in generative AI and technology management. Bring us your research question.
This item is an AI-generated summary of reporting by The Hacker News. Please check the original article for accuracy. Copyright in the original article belongs to The Hacker News.