Attackers backdoor official Anthropic extension on Cursor to target developers

What's Happening

• Attackers compromised Anthropic's official account on the Cursor marketplace to distribute a backdoored Claude Code extension, affecting up to 5,000 users.
• The malware attempted to harvest user data including hostnames, usernames, operating systems, and public IP addresses.
• The malicious package attempted to install a persistent SSH backdoor across Windows, macOS, and Linux systems to access local files and source code.
• Cursor pulled the extension and took its entire marketplace offline to neutralize the threat before reinstating the service.

Why It Matters

Developers rely on AI coding assistants to accelerate their workflows. This reliance makes development environments attractive targets for supply chain attacks. Compromised extensions expose proprietary source code and internal network access.