Fake Claude Code Extension Pops Up on Cursor Marketplace, Threatening Thousands of Developers

A counterfeit version of Anthropic's Claude Code extension for Visual Studio Code appeared on Cursor's extension marketplace for roughly eleven hours on October 29, putting an estimated 5,000 developers at risk of malware that can install persistent SSH backdoors on their machines. Security researchers first spotted the rogue package after detecting unusual network traffic from systems that had recently installed the extension.

The malicious add‑on was designed to imitate the legitimate Claude Code tool, which helps developers generate code snippets using Anthropic's large language model. By exploiting the trusted branding, the attackers succeeded in drawing users into downloading the compromised package through Cursor's official distribution channel, a scenario that underscores the growing danger of supply‑chain attacks in the software development ecosystem.

After installation, the extension ran a concealed payload that created SSH keys and appended them to the victim's authorized_keys file, granting the attacker persistent, password‑less access to the host. The backdoor was built to survive reboots and persist across updates, giving threat actors a foothold for further intrusion or data exfiltration. Because the malicious code operated silently, many developers remained unaware of the compromise until security tools flagged the unexpected SSH activity.

Cursor removed the rogue extension shortly after it was reported, and the marketplace was temporarily taken offline for a thorough review of its vetting procedures. Anthropic issued a statement confirming that the official Claude Code extension had not been compromised and urged users to verify the source of any downloads. The incident highlights the importance of verifying extension provenance, especially when dealing with tools that integrate directly into development environments.

Experts say the episode serves as a reminder that even short‑lived exposure can have lasting consequences for the open‑source and developer communities. Organizations are advised to monitor for unauthorized SSH keys, enforce multi‑factor authentication where possible, and adopt strict extension approval workflows. As the investigation continues, security firms are analyzing the malware's command‑and‑control infrastructure to determine the actors behind the campaign and assess whether additional targets beyond the Cursor marketplace were affected.