Fake Claude Code Extension Installed an SSH Backdoor

On October 29, a malicious clone of the Claude Code extension (Anthropic's AI coding assistant for code editors) was published in the extension marketplace for Cursor, a code editor built on VS Code. The malicious extension stayed available for almost 11 hours. When installed on macOS or Windows systems, it tried to steal the victim's username, home directory path, and Git settings. Then it tried to add an extra authentication key so that remote parties could log in through a connection to 134.209.82.225. Up to 5,000 users may have been affected. The malicious extension was not written by Anthropic.

This case shows how trust in extensions can be turned against users in code editors. It also points to something important: checking where a package actually comes from matters a lot when you use AI coding assistants.