Malicious Claude Code Extension Reached 5,000 Developers via Cursor Marketplace

The plugin marketplace of AI coding tool Cursor once hosted a tampered Claude Code extension. The malicious version stayed online for about 11 hours, and around 5,000 developers were affected.

Cursor confirmed the malware installed a persistent SSH backdoor on user devices. It collected usernames, hostnames, public IPs, Git emails and names of sensitive environment variables, then sent the data to the attacker's server. It also tried to add SSH keys and build reverse tunnels.

Researchers found the attacker did not change the original features. They only inserted a malicious loader at the start of the extension.js file. Due to SSH setup errors, such as calling a Unix shell on Windows, many devices may not have been opened to remote access.

Cursor has removed the extension and temporarily shut down its marketplace. It also worked with the hosting provider to cut off the attacker's server. The company said no other extensions or official channels were affected.