Malicious Claude Code Extension Served in Cursor Supply Chain Attack
Summary
A malicious Claude code extension was distributed through the Cursor IDE supply chain. The extension was designed to perform reconnaissance on the host system and establish a reverse SSH tunnel.
IFF Assessment
FOE
The malicious code extension indicates a successful supply chain attack, which is detrimental to defenders as it compromises development tools and potentially allows attackers to gain unauthorized access.
Defender Context
This incident highlights the continued risks associated with supply chain attacks, particularly within the software development ecosystem. Defenders need to be vigilant about the integrity of their development tools and the extensions they utilize, as compromised tools can lead to significant security breaches.