Trojanized Claude Code Extension Backdoored 5,000 Developer Machines via Cursor's Marketplace
On October 29, 2026, a trojanized version of Anthropic's Claude Code VS Code extension (v2.1.313) was distributed through Cursor's AI-powered code editor marketplace for approximately 11 hours, exposing up to 5,000 developers to malware. The malicious extension injected a JavaScript loader that silently collected system reconnaissance data—including Git email, hostname, and public IP—and attempted to install persistent SSH backdoors via macOS LaunchAgents or Windows scheduled tasks. Coding errors in the malware's SSH setup routines limited attacker access, but reconnaissance data was still transmitted to a remote server at 134.209.82[.]225. Cursor removed the extension, shut down its marketplace for auditing, and worked with the hosting provider to take the attacker's server offline. This incident underscores the growing threat of supply-chain attacks targeting AI-assisted developer tooling. As agentic AI tools become deeply embedded in software development workflows, adversaries are increasingly weaponizing trusted extension marketplaces to compromise developer endpoints at scale—making extension integrity verification and runtime behavioral monitoring critical priorities for security teams in 2026.
Kill Chain