What jumps out to me is how boring the malware sounds, in the worst possible way. No clever exploit chain, no exotic persistence trick, just a malicious extension that piggybacks on the same developer workflow people are using to make code edits faster. That is exactly why this feels nasty. If you use Claude Code or any other assistant inside your editor, you are already training yourself to treat extensions as part of the workspace, not something suspicious. Attackers know that.
The detail that Cursor says the malicious package sat in its marketplace for about 11 hours is uncomfortable for a different reason: that is long enough to matter, short enough to suggest the whole thing could have spread before anyone had a realistic chance to notice. If the exposure figure is really up to 5,000 developers, that is not “mass compromise” in the headline sense, but it is enough to hit real teams with real secrets on disk. And because the payload wasn’t trying to do one dramatic thing, it could easily blend into ordinary editor startup noise.
What I find more interesting than the SSH backdoor itself is the failure mode. The article says the malware’s SSH setup was buggy enough that on many Windows and macOS systems it likely couldn’t actually get remote access unless SSH was already enabled. That sounds like a lucky break, but I wouldn’t over-celebrate it. The script still collected host details, Git email, public IP, environment variable names, and it still tried to persist. In other words, even a clumsy operator can still get enough reconnaissance to come back later with a better payload.
There’s also an awkward question here that the article leaves open, and rightly so: how did a malicious extension get published under Anthropic’s name in Cursor’s marketplace at all? If Cursor’s marketplace trust boundary is weak enough that this happened, that is the real story. Not because Anthropic is at fault by default — the piece explicitly says Anthropic didn’t make the malicious extension — but because developers are now being asked to trust a chain that includes the editor vendor, the marketplace, the publisher identity, the extension package, and whatever update mechanism ties them together. That is a lot of trust for something that auto-runs in your shell-adjacent environment.
If I were running a dev team, I’d be less interested in the exact malware family and more interested in whether my people have a habit of installing editor extensions with broad permissions on machines that also hold SSH keys, cloud credentials, and access to internal repos. That’s the real exposure here. The attack works because the modern development workstation has become a privileged control plane. We keep acting like it’s just a text editor. It isn’t.
Reference: Malicious Claude Code extension on Cursor planted SSH backdoors
