Backdoor Found in Compromised Claude Code Extension
An unauthorized and maliciously modified version of the Claude Code extension was uploaded to the Cursor IDE extension marketplace, remaining active for several hours. The compromised extension introduced severe security risks, including the unauthorized addition of SSH keys to affected developer machines. This supply chain attack directly targets developer environments, potentially exposing sensitive source code, internal systems, and credentials of up to 5,000 users. It highlights growing vulnerabilities in IDE extension marketplaces where trusted development tools can be weaponized against developers. According to security disclosures, the malicious extension was live on the Cursor marketplace from approximately 2:27 a.m. PT to 1:35 p.m. PT. Clarifications from Cursor noted that the compromised release was not developed by Anthropic, but rather represented a supply chain tampering incident.
## BACKGROUND
IDE extensions and marketplaces allow developers to install tools and plugins directly into their coding environments, such as Visual Studio Code or Cursor, to enhance productivity. However, because these extensions often require broad permissions to read and write files or execute commands, a compromised extension can grant attackers deep access to a developer's local machine.