Malicious Claude Code extension spreads through Cursor marketplace for 11 hours
AICursor's extension marketplace distributed a tampered Claude Code extension, version 2.1.313, for about 11 hours on October 29 and 30, potentially reaching 5,000 developers. The malware added a loader to extension.js that collected user and environment details and installed a persistent SSH backdoor.
AIWhy it matters.
The report gives the malware's persistence and data-theft behavior, plus Cursor's takedown and remediation steps, useful for developers checking whether they installed the affected extension.
Source details
IThome · AI · ithome.comPublished · added here
Original title: 11 小时影响约 5000 开发者：AI 编程工具 Cursor 官方商城出现恶意 Claude Code 插件