A Trusted Extension Turns Against Its Users

Researchers have disclosed that the official Anthropic Claude Code extension distributed through the Open VSX registry was compromised and used to plant a persistent SSH backdoor on infected machines. The finding, reported by The Hacker News, is a stark reminder that even extensions bearing a well-known vendor's name are only as trustworthy as the pipeline that publishes them.

According to the report, the malicious activity has since been traced back to a compromise of the Cursor Marketplace. Cursor, the AI-assisted coding platform, briefly took the marketplace offline in order to purge the malware, and the company acknowledged the event as a security incident.

How the Attack Chain Reportedly Unfolded

The core of the incident is a supply chain problem. Rather than exploiting a flaw in the extension's code, the attackers appear to have gained control of the publishing path so that a tampered build of the Claude Code extension could be served to users through Open VSX, the open-source extension registry that many alternative editors and IDE forks rely on.

Once installed, the payload's objective was persistence. The compromised extension was used to establish an SSH backdoor, giving the operator a durable foothold on the developer's workstation. That is a particularly damaging outcome in a software development context: a developer laptop is not just a personal machine, it is a gateway to source code repositories, CI/CD credentials, cloud consoles, and internal networks.

The trail led investigators to the Cursor Marketplace, which had itself been compromised. Cursor's decision to take the marketplace down briefly reflects a containment-first approach — removing the distribution channel so that the malicious package could no longer be pulled, while the affected listing was scrubbed.

Why Open VSX and Marketplace Distribution Matter

The Open VSX registry exists precisely because the mainstream VS Code Marketplace is not universally accessible. Editors such as VSCodium and various vendor forks depend on it, and enterprises sometimes mirror it internally. That makes it a high-value target: a single compromised publisher account or token can push a poisoned build to a broad, technically sophisticated user base that has little reason to suspect the extension is anything other than legitimate.

Marketplaces aggregate trust. When a developer installs an extension from a named vendor, they are implicitly trusting the registry's verification, the publisher's account security, and the integrity of the build pipeline. This incident shows how thin that chain can be when any one link — in this case, marketplace infrastructure — is breached.

The SSH Backdoor as a Persistence Mechanism

SSH backdoors are an attractive choice for attackers because they blend into normal developer behavior. Developers routinely use SSH for Git operations, remote shells, and deployment. A rogue authorized key or a modified SSH configuration entry can grant the attacker recurring, passwordless access that survives reboots and often evades casual inspection.

For defenders, this means an infected host should be treated as fully compromised. Rotating credentials is not enough on its own. Investigators would need to audit authorized_keys files, SSH daemon configuration, shell profiles, scheduled tasks, and any newly created user accounts, and they should assume that secrets reachable from that workstation — repository tokens, cloud keys, signing certificates — may have been exposed.

Practical Guidance for Development Teams

The most immediate action is inventory. Organizations should determine whether the Claude Code extension was installed from Open VSX or via the Cursor Marketplace during the exposure window, and identify which developer endpoints are affected.

Beyond that, several durable lessons apply:

  • Pin and verify extension versions. Treat IDE extensions like any other third-party dependency, with approved versions and integrity checks where the registry supports them.
  • Harden publisher accounts. Marketplace and registry accounts should use phishing-resistant MFA, and publishing tokens should be scoped and rotated.
  • Monitor SSH trust material. Alert on changes to authorized_keys and SSH configuration files on developer endpoints, not just on servers.
  • Isolate developer workstations. Least-privilege access and network segmentation limit what an attacker can reach from a single compromised laptop.
  • Prefer curated internal mirrors. Organizations that mirror extension registries internally can vet and freeze packages before they reach developers.

The Bigger Picture

AI coding assistants have become deeply embedded in the software supply chain, and that makes their distribution channels a prime target. This incident did not exploit a vulnerability in the AI model or the extension's logic; it exploited trust in a marketplace. As AI tooling continues to spread across developer environments, the security of registries, publisher identities, and update mechanisms deserves the same scrutiny we already apply to package managers and build systems.

Cursor's rapid takedown of its marketplace likely limited the blast radius, but the event underscores a simple point: an extension is only as trustworthy as the weakest system that can publish it.