Supply Chain Alert: Malicious ‘Claude Code’ Extension on Cursor Marketplace Deploys Persistent SSH Backdoor
Event Core
Security researchers have identified a sophisticated supply chain attack on the Cursor extension marketplace, where a malicious plugin masquerading as the official “Claude Code” by Anthropic was discovered. Leveraging the hype surrounding Anthropic’s recent launch of its Claude Code CLI, threat actors uploaded a fraudulent VS Code-compatible extension designed to install a persistent SSH backdoor on developer workstations. This incident highlights a critical vulnerability in the rapidly expanding ecosystem of AI-assisted development tools.
In-depth Details
The exploit functions as a classic brand-jacking attack. By utilizing Anthropic’s official branding and the exact name of their new tool, the attacker bypassed the psychological defenses of developers eager to integrate the latest LLM capabilities into their workflow. Once installed, the extension executes a payload that modifies the host’s SSH configuration—typically by appending a rogue public key to authorized_keys—granting the attacker persistent, remote shell access.
The technical sophistication lies in its simplicity and timing. While modern IDEs like Cursor offer immense productivity gains, their marketplace vetting processes are currently struggling to keep pace with the sheer volume of GenAI-related submissions. This creates a “security vacuum” where malicious actors can hide remote access trojans (RATs) inside seemingly helpful AI productivity wrappers.
Bagua Insight
At Bagua Intelligence, we view this as a pivotal moment in the “AI Tooling Wild West.” Developers are no longer just the builders of secure systems; they are now the primary high-value targets for corporate espionage. A compromised developer machine is a gateway to the entire CI/CD pipeline, proprietary LLM prompts, and sensitive cloud infrastructure keys.
This incident also underscores a structural risk in the AI industry: the “Official Tooling Gap.” When major labs like Anthropic or OpenAI release tools in one format (e.g., CLI), the market’s demand for other formats (e.g., IDE extensions) creates an opportunity for third-party imposters. The speed of AI adoption is currently outstripping the speed of platform governance, making the developer’s IDE a frontline in global cybersecurity.
Strategic Recommendations
- Immediate Audit: Developers must verify the provenance of any “Claude” branded extensions. Confirm that Anthropic has not officially released a Cursor/VS Code extension for Claude Code yet; it remains a CLI-first tool.
- Endpoint Detection: Security teams should deploy EDR (Endpoint Detection and Response) tools to monitor for unauthorized modifications to SSH directories and unusual outbound traffic on port 22.
- Marketplace Hygiene: Adopt a “Zero Trust” posture toward third-party IDE marketplaces. Use internal private registries or curated allow-lists for extensions within corporate environments.
- Credential Rotation: If you have installed this extension, assume the environment is compromised. Rotate all SSH keys, API tokens, and cloud credentials stored on that machine immediately.