Malicious Claude Code extension in Cursor marketplace reportedly reaches 5,000 users
A trojanized Claude Code extension appeared in Cursor's marketplace and reportedly reached 5,000 users, with the malicious versions attempting to install an SSH backdoor. Cursor has removed the extension, but removal does not undo the damage.
Who is affected and how
- senior developer
- Check the publisher of your installed Claude Code extension and, on any affected machine, rotate tokens and keys.
- tech lead
- Set rules on which IDE marketplaces and publishers the team may install extensions from.
Sources
- Malicious Claude Code Extension Served in Cursor Supply Chain Attacksecurityweek · Nov 2, 2026
- Cursor removes malicious Claude Code extension after SSH backdoor attemptcso online · Nov 2, 2026
- An SSH backdoor has been discovered in 'Claude Code,' the official Cursor marketplace.gigazine · Nov 2, 2026
- A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Deviceswired.com · Nov 2, 2026
- Trojanized Claude Code 2.1.312 and 2.1.313 in Cursor Marketplace Plants SSH Backdoorrescana.com · Nov 2, 2026
- Fake Claude Code appears in Cursor marketplace, tries to install SSH backdoordigitaltoday.co.kr · Nov 2, 2026
- Cursor removes malicious Claude Code extension after SSH backdoor attempt - www.csoonline.comcsoonline.com · Nov 2, 2026
- Malicious Claude Code Extension Served in Cursor Supply Chain Attack - SecurityWeeksecurityweek.com · Nov 2, 2026
Machine-generated summary based on the titles and excerpts of the source articles. The facts come from the linked article.