What jumps out to me here is not that someone tried to sneak a backdoor into a developer tool marketplace. That part is sadly ordinary. What’s a little more unsettling is that the payload lived inside something branded as a Claude Code extension, inside Cursor’s ecosystem, and apparently had enough distribution to land on a few thousand machines before it was yanked. If you build with Claude, that should make you pause. The attack isn’t really “on Anthropic” or even “on Cursor” so much as on the layer where developers stop thinking of extensions as software and start thinking of them as convenience.
The SSH angle is the detail I keep coming back to. A reverse SSH tunnel is a very old-school move, which I think is exactly why it’s worth noticing. It’s not glamorous malware. It’s practical. It tries to get durable access, then persistence, then a path back in. That feels more like an operator trying to turn a developer workstation into a foothold than a smash-and-grab campaign. And the fact that the code was collecting hostname, username, OS, architecture, working directory, and Git email tells you this was not random noise. Someone wanted to inventory the machine and the human attached to it.
I also think the story is a reminder that “official channel” only means something if you know which official channel you mean. Anthropic says its own distributions weren’t affected, and Cursor says the compromised versions were only in its marketplace. Fine. But the average developer is not going to keep a mental model of which extension store is upstream, which one is mirrored, which one is signed by whom, and which one is just close enough to look right in a hurry. That confusion is part of the attack surface now.
The one claim I’d treat carefully is the implication that the SSH step was effectively blocked because admin rights were needed. Maybe, but “blocked” is a little too neat for my taste. The article itself says the extension dropped persistence scripts and that uninstalling may not be enough. So even if the tunnel didn’t come up cleanly, the operator may still have gotten something useful out of the run. In incidents like this, “failed” often just means “failed to do the loudest part.”
If I were auditing a team using Cursor plus Claude Code, I would care less about the specific extension version numbers and more about two questions: did anyone install anything from the marketplace during that window, and do we have a way to detect SSH key changes or startup persistence added by a developer tool? Those are boring questions. They’re also the right ones.
Reference: Malicious Claude Code Extension Served in Cursor Supply Chain Attack
