Malicious Claude Code extension on Cursor planted SSH backdoors

A malicious version of Anthropic's Claude Code VS Code extension was distributed via Cursor's extension marketplace for approximately 11 hours on October 29. The fake extension exposed up to 5,000 developers to malware designed to install persistent SSH backdoors on their systems. The attack targeted software developers using the Cursor IDE, a popular AI-assisted coding environment. The malicious package masqueraded as a legitimate tool to gain trust and installation. SSH backdoors allow attackers persistent remote access to compromised machines. The incident highlights risks in third-party extension marketplaces for developer tools. The supply chain attack vector is particularly concerning given the high-privilege environments developers typically operate in.