Cursor Warns of Tampered Claude Code Extension Installing SSH Backdoor
Cursor disclosed tampered versions of the Anthropic.claude-code extension (2.1.312/2.1.313) in its marketplace that lay dormant for 11 hours and attempted to install a persistent SSH backdoor, calling it a supply-chain poisoning incident not developed by Anthropic.
2026-11-09 ~ 2026-11-10 · 2 related posts
- Episode 1: Officially-branded Claude Code extension poisoned in Cursor marketplace supply-chain attack(2026-10-30, 23 posts)
- Episode 2: Malicious Claude Code Extension Backdoors Cursor Marketplace(2026-11-02, 3 posts)
- Episode 3: Cursor Warns of Tampered Claude Code Extension Installing SSH Backdoor(2026-11-09, 2 posts)
- Cursor: Malicious Claude Code extension versions sat in marketplace 11 hours, tried SSH backdoor — dl_weekly · 2026-11-09
- Cursor discloses tampered Claude Code extensions attempting persistent SSH backdoors — thione · 2026-11-10