Technology
Trojanized Claude Code extension exposed thousands of developer machines to persistent access
A malicious Claude Code extension distributed through Cursor’s Open VSX-based marketplace ran when activated and attempted to establish SSH access, persistence and an attacker-controlled connection. Cursor removed the package, rebuilt its marketplace and disabled the server, but those actions do not clean affected machines. The source estimates that up to 5,000 users may have been exposed and says the compromise route remains unknown. Users of version 2.1.313 need remediation, credential rotation and endpoint review.
Editorial summary · Publisher article
What matters
- The malicious package was identified as version 2.1.313, with version 2.1.314 presented as the clean replacement.
- The payload could leave SSH keys, persistence mechanisms and files even after uninstalling the extension.
- Open VSX is a distribution dependency for several VS Code derivatives, widening the trust boundary.
- The publisher account’s association with an Anthropic employee does not establish who uploaded the package.
Why the incident matters
Editor extensions inherit the developer’s local permissions and may reach source code, terminals, SSH configuration and authenticated cloud tools. The incident therefore illustrates how a compromised package registry can turn an ordinary update path into a software supply-chain intrusion.
Context & caveats
- The maximum exposure estimate is attributed to Cursor, and the source does not establish that every exposed machine was successfully compromised.
- The source says the intrusion route remains unidentified.
Why this made the edition
Detailed security reporting identifies the malicious extension version, execution behavior, exposure estimate, uncertain compromise route and concrete remediation implications for developers and organizations.
Source material