suspectedhighSupply chainFirst reported Oct 30, 2026 · Disclosed Nov 2, 2026
Cursor: backdoored Claude Code extension distributed via its marketplace for about 11 hours
A maliciously modified version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for roughly 11 hours on October 29, attempting to install a persistent SSH backdoor on Windows and macOS developer machines. Cursor said about 5,000 users downloaded the malicious extension, and it briefly took down the marketplace to remove the malware.
Members only
The full record: the timeline and 10 linked reports
- Every update as it happened, with the status at each step
- Every report behind the record, newest first
- Alerts the moment Cursor — or anything else you track — is hit again
A free account is all it takes — no card, one minute.