Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor

The distribution of a compromised software update, identified as version 2.1.313 of the Claude Code extension, highlights a potential vulnerability in how software marketplaces verify updates. The incident involved the malicious update appearing under the legitimate publisher's identity on the Cursor Marketplace, suggesting either a compromise of the publisher's account credentials or a bypass of marketplace integrity checks.

The presence of an SSH backdoor in the trojanized extension indicates an attempt to gain unauthorized, persistent remote access to users' systems. An SSH backdoor allows an attacker to control a machine covertly, which could impact developers using the extension for coding tasks by exposing their development environment.

Cursor's decision to temporarily shut its marketplace suggests a reactive measure to contain the threat after its detection. This action points to the challenge of proactively preventing such attacks, especially when malicious software successfully mimics legitimate updates and exploits trusted publisher identities. For users, the incident underscores the importance of scrutinizing software sources and updates, even when they appear to come from official channels.