Trojanized Claude Code Extension on Cursor Marketplace Installs Persistent SSH Backdoor
What Happened — Researchers discovered that a malicious update (v2.1.313) of Anthropic’s official Claude Code VS Code extension was published on the Cursor Marketplace under the legitimate publisher name. The update contained a hidden payload that, when installed, created a persistent SSH backdoor on the victim’s machine, allowing remote command execution. The trojanized package was distributed as a routine update, and Cursor temporarily removed the extension after the abuse was reported. No public evidence of active exploitation has been disclosed, but the backdoor could be leveraged to exfiltrate code, credentials, or other development‑environment assets.
Why It Matters for Trust & Control Assurance — The incident highlights the need for continuous third‑party risk monitoring and verifiable evidence that vendor‑supplied components remain untampered.
Who Is Affected — Software developers, SaaS platforms, and any organization that installs VS Code extensions from third‑party marketplaces.
Recommended Actions
- Inventory all installed VS Code extensions and verify their provenance.
- Remove the compromised Claude Code version and reinstall from a trusted source.
- Enable multi‑factor authentication and host‑based firewalls for SSH access.
- Incorporate extension‑supply‑chain checks into your vendor risk program and collect audit evidence of control effectiveness.
Technical Notes
- Attack vector: Trojanized third‑party extension (Cursor Marketplace).
- Payload: Persistent SSH backdoor that creates a hidden user and authorized key.
- Discovery: Reported by independent security researchers; Cursor responded by pulling the extension.
- Impact: Potential remote access to development machines; no confirmed data exfiltration reported.