FULL STORY

Claude Code Extension Poisoning: From Discovery to Cursor's Disclosure

A fake "official" Claude Code extension poisoned Cursor's marketplace with an SSH backdoor for ~11 hours, hitting ~5,000 users; Cursor later issued a security advisory disclosing the tampered versions.

2026-10-30 ~ 2026-11-10 · 3 episodes · 28 posts

Episode 1 · Officially-branded Claude Code extension poisoned in Cursor marketplace supply-chain attack (2026-10-30, 23 posts)

The officially-branded Claude Code VS Code extension suffered a supply-chain attack: a malicious version self-identifying as anthropic.claude-code was published on Cursor's own extension marketplace, with a 66-line loader prepended to extension.js that adds an attacker SSH public key to users' authorizedkeys and establishes a cross-platform persistent backdoor. Cursor confirmed the trojanized version was live from 09:27–20:35 UTC on Oct 29 (11 hours), potentially affecting up to 5,000 users, after which the entire marketplace was taken offline. Because the poisoned package carried the official identity (29M+ cumulative installs shown on the Marketplace) rather than being an obvious fake, the incident exposes deep trust flaws in IDE extension distribution.

Confirmed

  • Cursor's official notice: trojanized anthropic.claude-code v2.1.313 was available 09:27–20:35 UTC on Oct 29 for about 11 hours, affecting up to 5,000 users on platforms including macOS ARM64; Cursor took the whole marketplace offline that afternoon. djcroman notes the tampered versions span 2.1.312 / 2.1.313
  • The malicious version was found by security firm Phorion (Matt Johansen also disclosed it early); 66 malicious loader lines were inserted before the legitimate code in extension.js
  • Once activated, the code adds an attacker public key to /.ssh/authorizedkeys, attempts to enable local SSH, and establishes reverse connections; Phorion's analysis shows cross-platform persistence on macOS, Linux and Windows
  • The extension shows over 29 million cumulative installs on the Marketplace (feelspeaceman relaying researchers), so tampering with the official package implies huge potential reach
  • Per a leak relayed by banteg, the OpenVSX publisher is Anthropic employee Igor Kofman; whether his account was compromised or another publishing step exploited remains unclear
  • cyb3rops clarified: the tampered extension was distributed via Cursor's own marketplace; Anthropic's official channels, the Microsoft VS Code Marketplace and Open VSX were unaffected — contradicting earlier descriptions (jedisct1, banteg) placing the poisoned release on the Open VSX registry; jedisct1 notes OpenVSX is the store used by all VSCode forks and its publisher is the Anthropic employee
  • Anthropic engineer Felix Rieseberg relayed Cursor's statement (via EricBuess), confirming attackers used marketplace access to publish the tampered version
  • 0xkarasy relayed security-team checks: the official extension on Microsoft's marketplace and Anthropic's npm packages were unaffected; the malicious version was removed
  • 0xOsprey broke the news earliest (amplified by evilsocket), noting it received almost no media coverage
  • dbasch points to the structural root cause: extension marketplaces lack signing and review, letting anyone inject backdoored extensions — a 'Wild West' security posture

Unconfirmed

  • Cursor's statement (via EricBuess) says the malicious version was not developed by Anthropic, at odds with sources describing the official extension itself as tampered; how the publishing account was exploited and the exact distribution path await authoritative conclusions
  • amasad speculated the backdoor might relate to the Binance wallet hack — pure conjecture with no supporting evidence
  • Researchers including WeldPond criticized Anthropic for silently delisting without notifying users; no official response yet

Why it matters

  • The poisoned target was an officially-branded package with tens of millions of installs, allegedly published from an Anthropic employee's own account — ordinary users had no way to tell it apart, highlighting supply-chain trust issues in extension registries and IDE marketplaces
  • The backdoor targets SSH configuration and persistence, with impact well beyond a single IDE; affected users should check for unknown public keys in their SSH config
  • The near-total absence of early coverage shows the security community's low alertness to IDE extension supply-chain attacks

3 more related posts →

Episode 2 · Malicious Claude Code Extension Backdoors Cursor Marketplace (2026-11-02, 3 posts)

Cursor's extension marketplace was compromised for about 11 hours, serving malicious versions of the Claude Code extension that installed SSH backdoors, highlighting supply-chain risks in developer toolchains.

Episode 3 · Cursor Warns of Tampered Claude Code Extension Installing SSH Backdoor (2026-11-09, 2 posts)

Cursor disclosed tampered versions of the Anthropic.claude-code extension (2.1.312/2.1.313) in its marketplace that lay dormant for 11 hours and attempted to install a persistent SSH backdoor, calling it a supply-chain poisoning incident not developed by Anthropic.