DooDooLamb News
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor - The Hacker News
Brief published November 2, 2026 ยท Original source published November 1, 2026
Original reporting by feedfeeder at slashdot.org.
Automated brief. Verify important details at the original source.
What happened
A supply chain attack trojanized the official Claude Code extension on the Cursor marketplace, embedding a persistent SSH backdoor. Cursor disclosed that up to 5,000 users were affected by the tampered extension. Coverage from both The Hacker News and WIRED confirms the extension reached a meaningful number of developer devices before the compromise was identified. The attack vector was the marketplace distribution channel itself, not individual user behavior.
Why it matters
Developer tools and IDE extensions are high-value targets because they run with elevated trust on machines that typically hold credentials, source code, and cloud access. A persistent SSH backdoor on a developer workstation can provide long-term access well beyond the initial infection window. This incident demonstrates that even extensions tied to recognized AI vendors are not immune to supply chain compromise.
What to watch
Whether Cursor or Anthropic disclose the full scope of what data or systems the backdoor accessed, how the tampered package entered the official marketplace, and what verification controls either party adds to prevent recurrence.