Malicious Claude Code Extension Found in Cursor Plugin Marketplace, Removed After 11 Hours

AI coding tools are becoming a new target for supply chain attacks. According to a disclosure by a YouTube tech channel, an extension named Claude Code in the plugin marketplace of the AI code editor Cursor was found to contain malicious code and remained downloadable for about 11 hours. This incident is another reminder to developers: the convenience of plugin ecosystems often comes with security risks.

What Happened: A Tampered Extension

According to the video, an attacker published a tampered version of Claude Code in Cursor's extension store. The extension itself is a commonly used AI coding assistant, making it easy for users to trust and install. The malicious version embedded backdoor code that attempted to establish covert access channels on users' machines, collect user information, and allow the attacker to remotely connect to the system.

One detail worth noting: the malicious code did not perform a single action but combined two high-risk behaviors—information theft and remote control. For developers who handle code, keys, and configuration files in local environments every day, the potential harm of such a backdoor far exceeds that of ordinary malware.

Supply Chain Attack refers to an attack in which adversaries do not directly target the end victim but instead compromise third-party components, tools, or distribution channels the victim relies on, using the trust relationship to deliver malicious code downstream. In software, typical forms include tampering with open-source packages, hijacking update servers, and impersonating well-known extensions. The stealth of such attacks lies in the fact that users often download a "normal" tool while the malicious logic is embedded in a trusted distribution chain, making traditional reputation judgments (such as brand names and feature descriptions) ineffective. Plugin marketplaces for AI coding tools, with frequent version updates and reviews focused on functionality rather than security, have become a high-incidence area for supply chain attacks.

Scope of Impact and Incident Response

Cursor stated in its notice that up to 5,000 users may have been affected by this incident. This figure comes from the company's preliminary assessment, and the actual number of affected users may vary depending on installation and execution circumstances.

A key detail: due to technical flaws in the malicious code itself, the attacker's full access attempts did not succeed on many machines. This means not all users who installed the extension were truly exposed to remote control risks, but the official statement did not further distinguish whether information collection succeeded.

Cursor's response was relatively swift: it removed the malicious version from the plugin marketplace and shut down the server used by the attacker. However, looking at the timeline, the malicious extension was downloadable for about 11 hours—a window long enough for a considerable number of users to complete installation.

Backdoor is malicious code that bypasses normal authentication and preserves a covert access channel for an attacker. Unlike destructive malware such as ransomware, backdoors usually operate silently, with goals including long-term persistence, credential theft, and lateral movement. In development environments, once a backdoor is activated, an attacker can read source code, API keys in environment variables, SSH configurations, and even cloud platform access tokens, thereby expanding the scope of intrusion. In this incident, the malicious code contained both information theft and remote control functions, making it a composite backdoor with a higher risk level than a single-function malicious extension.

Anthropic's Official Channels Unaffected

One point easily misread in this incident is the ownership of Claude Code. The video explicitly states that Anthropic's official distribution channels were not affected by this attack. In other words, the problem lies in the distribution link of a third-party plugin marketplace, not in the official release chain of Claude Code itself.

The practical takeaway for developers is: AI tool extensions obtained from unofficial channels cannot be trusted to the same degree as official versions. Even if the extension name and feature description match the legitimate version, the code may have been replaced.

The Security Dilemma of Plugin Ecosystems

Plugin marketplaces for AI coding tools are essentially open distribution platforms, and review mechanisms usually struggle to cover every version update. Attackers exploit this by gaining initial trust and then injecting malicious code through updates. Such tactics have precedent in ecosystems like npm and the VS Code extension marketplace, and now extend to the AI editor space.

From a defensive perspective, measures developers can take include: prioritizing official channels when installing core tools, paying attention to an extension's publisher identity and update history, and staying vigilant about plugins requesting unusual permissions. For environments handling sensitive code or keys, isolated execution and regular auditing of installed plugins are safer practices.

The value of this incident is not panic but a reminder: as AI tools become deeply embedded in development workflows, the security boundaries of the plugin supply chain need to be re-examined. A seemingly ordinary extension update could be the entry point for an attack.

npm and the VS Code extension marketplace are two typical open package management platforms in the developer ecosystem. npm allows anyone to publish JavaScript packages, and historically there have been multiple malicious packages (such as typosquatting packages and the event-stream incident) that stole user data; the VS Code extension marketplace also uses a low-barrier publishing mechanism, and in 2023 malicious extensions disguised as popular themes appeared. These platforms share common characteristics: easy publishing, automated version updates, and reviews focused primarily on functional compliance, with security scanning unable to cover all incremental updates. AI editor plugin marketplaces continue this model, and attackers can bypass initial review by "first publishing a normal version to gain installs, then injecting malicious code through an update"—a tactic characteristic of this Cursor incident.

One-line Summary

A tampered Claude Code extension containing backdoor code appeared in the Cursor plugin marketplace and was downloadable for about 11 hours, highlighting supply chain security risks for AI coding tools.

Paragraph Summary

A tampered Claude Code extension appeared in the plugin marketplace of the AI code editor Cursor. The malicious version embedded backdoor code that attempted to establish covert access channels, collect user information, and enable remote connections. The extension remained downloadable for about 11 hours, and Cursor estimated that up to 5,000 users may have been affected; however, due to technical flaws in the malicious code, most full access attempts failed. Cursor has removed the malicious version and shut down the attacker's server, and Anthropic's official distribution channels were not affected. The incident reveals weak points in version update review within open plugin ecosystems and reminds developers to prioritize official channels, be wary of unusual permission requests, and use isolated execution and regular plugin audits in sensitive environments.