Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Malicious versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were distributed via the Cursor VS Code Extension Marketplace in a supply chain attack. These versions contained JavaScript code that performed host reconnaissance and attempted to establish a reverse SSH tunnel for persistence and remote access. The malicious extension was live for approximately 11 hours and potentially downloaded by around 5,000 developer systems on macOS and Windows. Cursor removed the malicious versions promptly, suspended the marketplace for investigation, rotated keys, and worked with the cloud provider to take down the attacker's server. The attack failed to establish the SSH tunnel on most systems due to lack of administrative privileges. Users are advised to remove the malicious extension versions and follow Cursor's remediation guidance to detect and eliminate persistence mechanisms.

• securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack/ (opens in a new tab)

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMalware2026-10-31
• $2 Million+ Drained From Polymarket Traders in New Supply Chain AttackNews2026-10-30
• Applying Security by Design and Cyber Immunity principles to protect AI systems | Kaspersky official blogAnalysis2026-10-29
• 26th October · Threat Intelligence ReportBreach2026-10-26
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksHighVulnerability2026-10-23