As cited
Copy frozen at (site build).
threat intel
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
A malicious version of Anthropic's Claude Code extension was distributed through the Cursor Marketplace under the legitimate publisher's identity, containing a persistent SSH backdoor. The compromised update, version 2.1.313, led Cursor to temporarily suspend the extension.
Why it matters: Developers using the Cursor editor and Claude Code extension face direct risk of system compromise and unauthorized remote access; verify your installed extension version and check for unexpected SSH access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
A malicious version of Anthropic's Claude Code extension was distributed through the Cursor Marketplace under the legitimate publisher's identity, containing a persistent SSH backdoor. The compromised update, version 2.1.313, led Cursor to temporarily suspend the extension.
Why it matters: Developers using the Cursor editor and Claude Code extension face direct risk of system compromise and unauthorized remote access; verify your installed extension version and check for unexpected SSH access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
A malicious version of Anthropic's Claude Code extension was distributed through the Cursor Marketplace under the legitimate publisher's identity, containing a persistent SSH backdoor. The compromised update, version 2.1.313, led Cursor to temporarily suspend the extension.
Why it matters: Developers using the Cursor editor and Claude Code extension face direct risk of system compromise and unauthorized remote access; verify your installed extension version and check for unexpected SSH access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
A malicious version of Anthropic's Claude Code extension was distributed through the Cursor Marketplace under the legitimate publisher's identity, containing a persistent SSH backdoor. The compromised update, version 2.1.313, led Cursor to temporarily suspend the extension.
Why it matters: Developers using the Cursor editor and Claude Code extension face direct risk of system compromise and unauthorized remote access; verify your installed extension version and check for unexpected SSH access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
A malicious version of Anthropic's Claude Code extension was distributed through the Cursor Marketplace under the legitimate publisher's identity, containing a persistent SSH backdoor. The compromised update, version 2.1.313, led Cursor to temporarily suspend the extension.
Why it matters: Developers using the Cursor editor and Claude Code extension face direct risk of system compromise and unauthorized remote access; verify your installed extension version and check for unexpected SSH access.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
A malicious version of Anthropic's Claude Code extension was distributed through the Cursor Marketplace under the legitimate publisher's identity, containing a persistent SSH backdoor. The compromised update, version 2.1.313, led Cursor to temporarily suspend the extension.
Why it matters: Developers using the Cursor editor and Claude Code extension face direct risk of system compromise and unauthorized remote access; verify your installed extension version and check for unexpected SSH access.
- Source published
- First seen by Cybersecurity Tracker