Cursor removes malicious Claude Code extension after SSH backdoor attempt
Summary
A malicious version of the Claude Code extension was distributed through the Cursor marketplace, attempting to install an SSH backdoor on developers' machines. Cursor removed the compromised versions, and Anthropic clarified that their official channels were not affected, with the attack targeting Cursor's marketplace.
IFF Assessment
The article describes a security incident where a malicious extension attempted to install a backdoor, posing a risk to developers' systems and sensitive data.
Defender Context
This incident highlights the supply chain risk associated with third-party extensions and marketplaces, especially in development environments. Defenders should be cautious of extensions, regularly review installed tools, and stay updated on security advisories from reputable sources.