Trojanized Claude Code Extension Discovered

Cybersecurity researchers have uncovered a serious security vulnerability in the Cursor Marketplace that affects users of the official Claude Code extension from Anthropic. A trojanized version of the extension, offered as a legitimate update, attempts to install a persistent SSH backdoor on affected systems. The dangerous version is labeled 2.1.313 and was distributed under the identity of the legitimate publisher.

The discovery was made by a team of security experts investigating the spread of the malicious software. The researchers found that the compromised extension could be downloaded from the Cursor Marketplace, significantly endangering users. The backdoor allows attackers to gain unauthorized access to users' systems and potentially steal sensitive data.

Actions by Cursor and Anthropic

In response to the discovery, Cursor promptly took measures to stop the spread of the malicious extension. The Marketplace was temporarily closed to conduct a thorough investigation and ensure the security of the platform. Users who downloaded the affected version were urged to check their systems for signs of compromise.

Anthropic, the publisher of the Claude Code extension, also released a statement informing users about the situation. The company is working closely with security researchers to clarify the circumstances of the incident and ensure that such security vulnerabilities are avoided in the future. The official version of the extension has been temporarily removed from the Marketplace until the security issues are resolved.

Risks and Impact on Users

Installing an SSH backdoor can have serious consequences for affected users. Attackers could not only access personal data but also take control of the systems, potentially leading to further security incidents. Researchers warn that affected users may not immediately notice that their systems have been compromised, as the backdoor operates in the background.

The security vulnerability has also raised questions about the trustworthiness of software marketplaces. Users often rely on the integrity of the platforms to ensure that downloaded extensions are safe. The incident could lead users to become more cautious and take additional security measures before installing third-party software.

Security researchers recommend that users regularly check their systems for malware and ensure that they only download software from trusted sources. Incidents like this highlight the need to remain vigilant and be aware of potential threats. The investigation into the incident is still ongoing, and further information is expected.