Malicious Claude Code extension on Cursor planted SSH backdoors
Summary
A malicious version of the Claude Code VS Code extension was available on Cursor's marketplace for about 11 hours, potentially exposing up to 5,000 developers. The malware was designed to install persistent SSH backdoors.
IFF Assessment
The discovery of malware designed to create persistent SSH backdoors represents a significant threat to developers and their systems.
Defender Context
This incident highlights the risks associated with third-party extensions in integrated development environments (IDEs) and the importance of vetting them. Defenders should be aware of potential supply chain attacks targeting developer tools and ensure robust endpoint security measures are in place to detect and block unauthorized modifications and persistent access mechanisms like SSH backdoors.