Backdoor Found in Claude Code VS Code Extension: A Cursor Marketplace Supply Chain Attack

According to disclosures from the security research community, the Claude Code for VS Code extension listed on the Cursor Marketplace was found to contain an implanted backdoor, through which attackers distributed a remote access trojan (RAT) to Claude developers worldwide. This incident is corroborated by three independent sources: Cursor's official security advisory blog post, a disclosure by security researcher GossiTheDog on cyberplace.social, and an in-depth analysis on doublepulsar.com. It quickly gained traction on Hacker News, earning 335 points and 353 comments and becoming a focal point of discussion in the developer community.

The Full Picture: How the Supply Chain Attack Happened

According to Cursor's official security advisory, the problem lay in the version of the extension listed on the Marketplace. The attackers did not directly breach Anthropic's infrastructure; instead, they exploited the trust chain in the extension distribution process to inject malicious code into a tool that developers use every day. This means that when developers installed or updated the extension within their IDE, they could have introduced a backdoor without any awareness.

Security researcher GossiTheDog was the first to raise the alarm on cyberplace.social, pointing out anomalous behavior in the extension. Subsequently, an analysis article on doublepulsar.com further revealed the intent of the attack: delivering a remote access trojan to Claude developers' laptops. The three sources corroborate one another, sketching a complete attack path from extension listing and distribution to endpoint compromise.

It is worth emphasizing that the danger of this type of attack lies in its targeting of developers themselves—a group that often holds higher system privileges, more sensitive project code, and broader infrastructure access. Once a developer's endpoint is compromised, attackers can move laterally into code repositories, CI/CD pipelines, and cloud environments.

Technical Breakdown: The Combined Threat of Backdoor and RAT

Based on the analysis from doublepulsar.com, this attack is not a simple malicious script injection but rather a combination of backdoor and remote access trojan capabilities. The backdoor maintains persistent access on the target system, while the RAT provides remote control, command execution, and data exfiltration. Together, they allow attackers to lurk in developer environments for extended periods.

As common components in the IDE ecosystem, extensions inherently possess the ability to read workspace files, execute commands, and access the network. Malicious extensions can leverage these legitimate permissions to bypass some security detection—which is why supply chain attacks repeatedly succeed within developer toolchains. The security research community widely agrees that the review mechanisms and runtime permission isolation of extension marketplaces are among the weakest links today.

Remote access trojan (RAT) is a type of malware that runs covertly on a target host and allows attackers to remotely control the system. Unlike ordinary viruses, a RAT typically provides capabilities such as an interactive shell, file upload and download, screenshots, keylogging, and even camera and microphone control, enabling attackers to operate the victim machine as if it were a local terminal. A RAT is often used in conjunction with a backdoor: the backdoor establishes and maintains a persistent channel (such as autostart, scheduled tasks, or service registration), while the RAT carries the remote control session over that channel. In developer scenarios, the value of a RAT lies in its ability to directly read source code, steal credentials (such as Git, cloud platform tokens, and SSH keys), and serve as a springboard for lateral movement into internal networks and production environments.

Supply chain attack refers to attackers not directly breaching the ultimate target but instead compromising an upstream link that the target trusts—a software vendor, distribution channel, build system, or third-party dependency—using legitimate distribution processes to deliver malicious code into the target environment. SolarWinds, Log4Shell, and various malicious npm package incidents all fall into this category. Its danger lies in the fact that malicious code carries the trust endorsement of a vendor or platform, can bypass reputation-based detection, and a single poisoning can affect a large number of downstream users. In this incident, the extension marketplace was the exploited link in the trust chain.

Permission isolation and runtime behavior monitoring are two core mechanisms for mitigating the risk of malicious extensions. Permission isolation requires extensions to run under the principle of least privilege—for example, declaring required capabilities through a manifest, restricting cross-workspace access, and placing extensions in a sandbox or separate process. Runtime behavior monitoring continuously observes an extension's file access, network connections, and child process creation, alerting on or blocking anomalies that deviate from the baseline (such as exfiltrating data to unfamiliar domains). Together, the two can significantly increase the likelihood of detecting malicious extensions.

Multi-Source Cross-Verification: Consensus Between Official Advisory and Independent Research

The sources of information for this incident are highly credible. The security advisory on Cursor's official blog confirms the existence and scope of the incident and constitutes first-hand authoritative information; GossiTheDog, as a well-known security researcher, provided an independent perspective through their social media disclosure; and the in-depth analysis on doublepulsar.com supplemented the attack's intent and technical details. All three sources are highly consistent on the core fact that "the extension was implanted with a backdoor and used to distribute a RAT to developers."

Regarding discrepancies, the sources are not yet unified in their descriptions of the attacker's identity and specific intrusion methods. The official advisory focuses on impact and remediation recommendations, while independent research pays more attention to the technical details of the attack chain. Such information gaps are normal in the early stages of a security incident. Developers should follow the remediation guidance in the official advisory while keeping an eye on follow-up tracking by independent researchers.

A Warning for the Developer Ecosystem

This incident once again exposes the fragility of the supply chain for AI programming tools. As AI coding assistants such as Claude Code become deeply embedded in development workflows, developers' reliance on extensions and plugins continues to grow—and so does the attack surface. The high level of discussion on Hacker News (353 comments) reflects the community's widespread concern about the security model of IDE extensions.

For developers, practical measures include: installing extensions only from trusted sources, paying attention to official security advisories, regularly reviewing the permissions and update history of installed extensions, and isolating development environments in sensitive projects. For platforms, strengthening extension listing reviews and introducing signature verification and runtime behavior monitoring are necessary investments to reduce similar risks.

AI programming tools are becoming a new hub in the software supply chain, and their security directly affects the security of countless downstream projects. This Claude Code extension backdoor incident is a costly reminder: while pursuing development efficiency, every link in the trust chain deserves re-examination.