Malicious Claude Code extension on Cursor marketplace plants SSH backdoors in 5,000 devs

A trojanized version of Anthropic's Claude Code VS Code extension was distributed via Cursor's extension marketplace for ~11 hours on Oct 29, affecting up to 5,000 developers. The malware installs persistent SSH backdoors, enabling unauthorized remote access. This is a supply-chain attack targeting the developer ecosystem, highlighting risks in third-party extension marketplaces.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works