Incident

Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

Why it matters: A malicious update to Anthropic's Claude Code extension was distributed through the Cursor Marketplace for about 11 hours, so developers should verify their extension version and check for unauthorized SSH access.

Covered by 3 outlets

  • The Hacker News - Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor ()
  • BleepingComputer - Malicious Claude Code extension on Cursor planted SSH backdoors ()
  • Dark Reading - Devs Hit by Trojanized Claude Code Extension for Cursor ()

Published

Start with real signal

See your security surface before you subscribe.

Run the complete AYAsec workflow on Free, then move to the cadence your team needs.

Start scanning free