Malicious Claude Code extension distributed in Cursor supply chain attack
SecurityWeek reports a malicious Claude Code extension was served through a supply chain attack affecting Cursor users. The extension reportedly performed host reconnaissance and attempted to open a reverse SSH tunnel.
Written by a model from the sources below. Verify against them.
- Kind
- Malicious package
- Vendor
- Cursor
- Product
- Claude Code-branded extension
- Status
- Reported, not confirmed
- First seen
What to do
Check whether the Claude Code extension is installed in Cursor and remove it if it is unverified
Review hosts that ran the extension for unexpected outbound SSH connections
Rotate SSH keys and credentials accessible from affected machines
Update Cursor and monitor for further advisories from the vendor
Timeline
- Made public by Mastodon
- First seen by cve.now2 days
- Record last updated
On X 10
Umair Nauman@UmairNauman_October in a nutshell: - Binance got hacked - PHP got hacked - Railway got hacked - OpenCode got hacked - Polymarket got hacked - GitHub Actions got hacked - SoftBank got hacked - Cursor marketplace got hacked - Coinbase vendor got hacked - Fireworks Al got hacked - LiteLLM got hacked - Capcom got hacked - Npm packages got hacked - TiDB Cloud got hacked - Warp's vendor got hacked
Shanaka Anslem Perera ⚡@shanaka86Anthropic's SpaceX agreements allow up to $120.5 billion of spending through 2029. If you are treating that as guaranteed sales, read the 90-day cancellation clause. Anthropic’s IPO filing, dated 26th October 2026, places the end of the initial non-cancellable periods in January and March 2027 under the respective agreements. After those periods, either company can cancel on 90 days' written notice. The same filing describes a different bargain with Amazon. Anthropic committed at least $110 billion over 10 years, regardless of usage, subject to specified adjustments and exceptions. That agreement is strictly non-cancellable except for Amazon's uncured material breach. These commitments give the suppliers different protection if Anthropic's computing needs change. The distinction matters to the calculation circulating around Elon's expansion. On SpaceX's 20th October earnings call, Elon targeted 2.5 to 3 gigawatts by year-end. His planned split between internal use and outside rentals was roughly half each, with room to move toward 60/40 in either direction. SpaceX calculates that capacity from installed GPUs and their power ratings. Their quarterly filing says this does not measure actual power consumption or utilization. The $150 billion calculation assigns rental income to the whole fleet. At an assumed $50 per watt annually, renting half of 3 gigawatts produces a $75 billion annualized revenue scenario. Renting 40% or 60% changes that to $60 billion or $90 billion at the same price. These calculations assume the allocated capacity is available and fully billed. Customers can pay for reserved capacity without running every GPU continuously. These figures establish neither profit nor guaranteed annual sales. The internal machines can also support paid products such as Grok and Cursor. That internal capacity has potential commercial value, and its allocation can change. SpaceX's financing adds another time horizon. Its 26th October filing disclosed a binding commitment to enter an equipment finance lease with approximately $40 billion of principal payments, plus interest and costs. The proposed lease schedules run about 5 to 5.25 years, with rent payable quarterly in advance once each equipment tranche starts its lease, expected in the first half of 2027. Closing conditions still apply. The financing filing does not match those future machines to Anthropic's contracts or the end-2026 capacity target. Short cancellation terms have value for SpaceX too. They let it reclaim computing capacity for its own models or seek better rental prices. Musk explicitly said he preferred short contracts because he expected the value of computing power to rise. That strategy can succeed. It can also leave future rental income exposed to changing prices even if the computers arrive and work exactly as planned. Financing the machines for years does not secure years of payments from today's customers.
Aleiah@AleiahLockgrok bot 1.0 has been sitting in a folder called "stable" on cursor's download server since oct 27, 23:14 utc that's 77 days after the aug 11 beta. spacexsi and cursor still haven't said a word the tasks hub from the same leak is the part i want. this guy runs so many bots he built his own dashboard to see which one is doing what one tab with every running session would cover that out of the box
Show 7 more posts
ddimitrov22@ddimitrovv22In case you didn't follow cybersecurity in October: >Binance lost ~$6.3B from its hot wallets in about 20 minutes, the largest crypto theft ever -Initial entry point: one engineer's compromised laptop -Chainalysis and TRM both attribute it to North Korea's TraderTraitor >PHP2Shell: two 14 year old bugs in the PHP interpreter gave unauthenticated RCE on WordPress, Drupal and Joomla servers -PHP runs ~70% of websites with a known server-side language -Found with AI help >Amazon's honeypots logged a PHP2Shell exploit attempt 4 days before the bugs were disclosed >China-aligned Storm-0940 used a stolen ConnectWise Cloud Backup credential to target 2,250+ Microsoft 365 tenants -Recon to exfiltration was run by ARTEX, an open-source multi-agent AI system -No MFA prompt, they signed in as an already-trusted app >OpenAI notified 100+ organizations that its own "misaligned" AI agents may have accessed their systems -OpenAI confirmed the agents probed SEC, Commerce and Education Department sites >LiteLLM's release pipeline was hijacked with stolen GitHub tokens and shipped a stealer to PyPI and Docker Hub -~23M weekly downloads, malicious version live for ~100 minutes -Stole cloud keys, SSH keys and Claude/Codex/Cursor auth files -Their second supply chain attack this year >Australia's cyber.gov.au went offline the night the PHP2Shell patches dropped -Along with government sites in France, Finland, Denmark and the Netherlands >A malicious Claude Code extension shipped under Anthropic's own extension ID on Cursor's marketplace -Added an attacker SSH key labeled "svc-telemetry" -Up to 5,000 users installed it in ~11 hours >Ledger X devices sold by a Malaysian reseller had a hardware implant that read seed phrases and sent them out over LTE -Researchers estimate $86M-$93M stolen from 300+ wallets >Capcom confirmed 11.77M CAPCOM ID records were accessed >Zeabur got breached twice in 2 months, then announced it's shutting down -2nd breach: long-lived admin credentials stored in plaintext -3.2M environment variable records exposed >eMudhra generated 8 intermediate CA keys with weak randomness, Chrome and Firefox blocked them, and eMudhra quit the global TLS business days later >GitLab patched two CVSS 10.0 RCEs in 9 days -The second one affects releases back to 2014 >Panasonic: an employee uploaded HR data on ~330K current and former staff and their families to a banned external AI tool -No hacker involved >Polymarket users lost ~$2.7M after a website performance script was hijacked to drain logged-in accounts -Second vendor-script drain on Polymarket this year >Rank Math PRO's own update server shipped a backdoor to WordPress sites for 11 hours >Plex2Shell got exploited a day after details went public -The attackers named their miner process "mylovelyminer" >A grey-market relay reconfigured Codex and Claude Code at 12 orgs to send all traffic through its servers and turn the sandbox off >Quest Diagnostics took its lab ordering system offline after unauthorized access, patient records believed exposed >CoinDCX confirmed a $16M loss days after its CEO called the reports a "false alarm" >Smaller crypto hits: -X100 $4.75M (flash-loan governance attack) -zkLink Nova $783K (bridge message replay) -Predict.fun $400K (compromised docs site) >Let me know what I missed If you work in security but don't have time to read 40 advisories a day - I post about web3 security every day. Follow so you catch the next recap🫡
Cobalt@CobaltHereA fake Claude Code build sat in Cursor's extension store for 11 hours. It ran before the extension did, planted an SSH key, and stays behind after you uninstall. How it worked and what to check. Read 👇 x.com/i/article/2116…
Ian Miles Cheong@ianmilesThe FBI says North Korea stole $6.3 billion from Binance, over four times the Bybit record. Early reports say it started with an engineer taking a “test.” Here is how Pyongyang got from bank heists to this, and where AI fits in. x.com/i/article/2116…
Karan Singh Arora@thisisksaOctober was brutal. Crypto exchanges, AI platforms, cloud infrastructure and software supply chains were all hit by security incidents. Some of the biggest names affected: 🔴 Binance → $6B+ stolen, FBI attributes attack to North Korea. 🔴 Polymarket → 737 wallets drained, $2.73M lost. 🔴 Capcom → 11.77 million customer records exposed. 🔴 Cursor Marketplace → malicious extension potentially reached 5,000 users. 🔴 PHP → PHP2Shell vulnerability actively exploited before public disclosure. 🔴 GitHub Actions → 500+ accounts linked to the GhostAction campaign. 🔴 OpenCode → 1.4% of Console users affected, unauthorized charges up to $1,700. 🔴 Railway → customer secrets accessed. 🔴 Warp → around 1% of its 800,000 users potentially affected. 🔴 LiteLLM → malicious release distributed credential-stealing malware. 🔴 Fireworks AI → customer environment variables accessed. 🔴 npm → malicious packages compromised through maintainer accounts. 🔴 Coinbase → customer contact data exposed through analytics vendor Amplitude. 🔴 TiDB Cloud → stolen credentials used to access internal systems. 🔴 SoftBank → unauthorized access attempt against My SoftBank. And this is only a fraction of the incidents reported. October was a serious reminder of how exposed the digital infrastructure we rely on has become. Your funds, credentials and personal data are all potential targets.
Farea@FareaNFtsOctober was a crazy month: • Binance got hacked • Polymarket got hacked • GitHub Actions got hacked • SoftBank got hacked • Cursor marketplace got hacked • Coinbase vendor got hacked • Capcom got hacked • TiDB Cloud got hacked • Warp's vendor got hacked happy cybersecurity awareness month
Inspired Analyst@inspirdanalystOctober was a really hard month - Binance got hacked - PHP got hacked - Railway got hacked - OpenCode got hacked - Polymarket got hacked - GitHub Actions got hacked - SoftBank got hacked - Cursor marketplace got hacked - Coinbase vendor got hacked - Fireworks Al got hacked - LiteLLM got hacked - Capcom got hacked - Npm packages got hacked - TiDB Cloud got hacked - Warp's vendor got hacked
Anastasiia@AnastasiiaGons1🚨OCTOBER 2026: CYBERSECURITY RECAP 15 security incidents. 6 attack surfaces. Different targets. Different weaknesses. CORE RUNTIME • PHP2Shell - PHP memory handling vulnerabilities. PLATFORM INFRASTRUCTURE & SECRETS • Railway - internal infrastructure & environment secrets. • Fireworks AI - internal credentials. • LiteLLM - compromised release pipeline. • TiDB Cloud - stolen service-account credentials. ACCOUNTS & AUTHENTICATION • Capcom - CAPCOM ID account system. • OpenCode - legacy Console & stored API keys. • SoftBank / IDC Frontier - authentication software vulnerability. EXCHANGE INFRASTRUCTURE • Binance - compromised hot-wallet infrastructure. SOFTWARE SUPPLY CHAIN • Polymarket - third-party monitoring script. • Cursor - malicious marketplace extension. • npm - compromised maintainer tokens & packages. • GhostAction - compromised GitHub accounts & workflows. THIRD-PARTY VENDORS • Coinbase - analytics vendor. • Warp - infrastructure vendor & agent telemetry. Elon was right, Every Day is a zero day. Want to understand the risks and learn how to protect yourself? Under this post my 5-part mini-series. 👇
Evidence 9
- SocialMastodon
“Cursor distributed two malicious Claude Code-branded extension versions for roughly 11 hours.”
- SocialBluesky
“Cursor Claude Code Extension Supply-Chain Attack Expands: Two Malicious Builds Confirmed as Infected Macs Establish Reverse SSH Tunnels + Video”
- Socialr/cybersecurity
“Inside a malicious Claude Code-branded extension and its persistent SSH backdoor”
- SocialMastodon
“Malicious # ClaudeCode extension on # Cursor planted # SSH backdoors”
- SocialMastodon
“Fake Claude Code update tried to open PCs to hackers”
Show all 9 sourcesShow fewer sources
- SocialBluesky
“Cursor has disclosed a security incident involving malicious versions of the Anthropic.claude-code extension distributed through its VS…”
- PressSecurityWeek
“The extension performed host reconnaissance and attempted to create a reverse SSH tunnel.”
- SocialMastodon
“Malicious Claude Code Extension Served in Cursor Supply Chain Attack”
- SocialBluesky
“This incident affects _only_ the Cursor Marketplace, and therefore only Cursor users.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-7b2beadb7b
Has Cursor confirmed it?
Mastodon, Bluesky and r/cybersecurity report an attempted attack. None of the sources says the attackers got in. No statement from Cursor has reached cve.now yet.Source: Mastodon, Bluesky, r/cybersecurity, Mastodon, Mastodon, Bluesky, SecurityWeek, Mastodon, Bluesky
What should Cursor users do?
Check whether the Claude Code extension is installed in Cursor and remove it if it is unverified. Review hosts that ran the extension for unexpected outbound SSH connections. Rotate SSH keys and credentials accessible from affected machines. Update Cursor and monitor for further advisories from the vendor.