Malicious Claude Code Extension Targets Cursor Users in Supply Chain Attack

Malicious versions of Anthropic’s Claude Code extension were recently distributed through the Cursor VS Code Extension Marketplace, exposing potentially 5,000 developer systems to a supply chain attack.

The incident, which took place on 29 October 2026, involved tampered versions 2.1.312 and 2.1.313 of the anthropic.claude-code extension. The compromised versions were available in the Cursor marketplace for roughly 11 hours before the threat was identified.

Technical details of the attack

The malicious extension contained JavaScript code designed to execute during module loading. This code performed host reconnaissance, collecting sensitive data including hostnames, usernames, operating system details, system architecture, working directories, and global Git email addresses.

Following the reconnaissance phase, the payload attempted to install an SSH key, enable the SSH service, and establish a reverse SSH tunnel to provide attackers with remote access. The malware also sought to configure persistence mechanisms to maintain its presence on the host system.

According to Cursor, the attempt to establish a reverse SSH tunnel failed on many macOS and Windows systems because enabling the local SSH service requires administrative privileges, which the extension typically does not possess.

Vendor response and remediation

Anthropic confirmed that the malicious versions were not developed or published by the company and that its official distribution channels were unaffected. The compromise was limited specifically to the Cursor marketplace.

Cursor responded by immediately suspending its marketplace to investigate the incident. The company has since rotated all security keys, rebuilt the marketplace, and worked with the cloud provider hosting the attacker’s server to take it offline.

Security researchers have warned that simply uninstalling the extension may not be sufficient to secure an infected machine. The payload is designed to drop standalone persistence scripts that continue to run after the extension has been removed.

Affected users should immediately isolate any hosts showing evidence of payload execution or backdoor installation. Cursor has released a detection script and indicators of compromise (IoCs) to help developers identify potential infections. Users are advised to remove unauthorised SSH keys and assess whether the host requires a complete rebuild.