Supply Chain Alert: Malicious 'Claude Code' Extension Targets Cursor Users

Developers using the Cursor IDE are being urged to audit their extensions after a supply‑chain attack involving a malicious clone of Anthropic’s Claude Code extension. The rogue extension was listed on the Cursor marketplace for roughly 11 hours on October 29, 2026, potentially exposing over 5,000 developers to malware that installs a persistent SSH backdoor on the victim’s machine.

Attack vector

The malicious extension mimicked the official Claude Code tool from Anthropic. According to security reports, once installed it dropped a payload that creates a persistent SSH backdoor, allowing an attacker to gain remote access to the developer’s environment [https://phorion.io/blog/offical-claude-code-vsx-compromise/].

A separate but related campaign was also highlighted in the same coverage: a fake Solana starter‑kit repository on GitHub was crafted to trick AI‑assisted coding agents into downloading the NetSupport Remote Access Trojan (RAT) [https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/].

Impact and response

Cursor has removed the malicious extension from its marketplace. Because the extension was live for nearly half a day, any developer who installed a Claude‑related extension during that window should assume the possibility of compromise.

Key details

• Exposure window: ~11 hours on Oct 29, 2026
• Estimated impact: over 5,000 downloads
• Primary payload: persistent SSH backdoor

How to secure your environment

If you use Cursor and installed any Claude‑related extensions, take these steps immediately:

1. Audit installed extensions – Open the Cursor extension sidebar and verify the publisher of every Claude‑related tool. The malicious version used a different publisher ID despite similar branding.
2. Check SSH authorized keys – Review ~/.ssh/authorized_keys for entries you do not recognize and remove any suspicious lines.
3. Rotate credentials – Regenerate GitHub tokens, AWS keys, and any other stored secrets.
4. Monitor network activity – Look for unexpected outbound SSH connections or traffic to unknown IP addresses.

The broader trend: AI supply‑chain attacks

This incident is part of a growing wave of malware targeting AI‑enhanced development tools. Recent reports also describe a resurgence of crypto‑mining malware on Hugging Face, where compromised GPU servers are used to mine cryptocurrency via malicious models [https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/]. As AI agents become more autonomous in writing and executing code, the attack surface for “prompt‑to‑malware” and “agent‑to‑backdoor” techniques continues to expand.

---

AI Disclosure: This article was written with the assistance of AI to summarize and synthesize technical security reports from the provided sources. All factual claims are derived from the cited URLs.

ai-disclosure

Illustration generated with AI.