Cursor Claude Code Extension Was Hijacked, Exposing 5,000 Developers to SSH Backdoor
A trojanized Claude Code extension on the Cursor marketplace planted SSH backdoors on up to 5,000 developer machines before it was pulled offline. An SSH backdoor can give an attacker persistent remote access to a machine. The incident matters because it is a supply-chain attack delivered through a trusted developer tool, aimed at exactly the people whose machines hold valuable code and credentials.
SOURCES
- Alpha Signal2026-10-30 07:46