Security · 3 November 2026
Cursor Marketplace malicious Claude extension performs host reconnaissance and SSH tunnel
A Claude code extension distributed via the Cursor Marketplace performed host reconnaissance and attempted to create a reverse SSH tunnel, highlighting a supply‑chain attack on the platform.
Day 3 of this story
What's new: Adds details on the extension’s host reconnaissance and reverse SSH tunnel behavior, beyond earlier report of distribution to 5,000 developers.
31 OctAnthropic's Claude Code Extension Trojanized on Cursor Marketplace with Persistent SSH Backdoor
1 NovCursor Marketplace Distributes Malicious Claude Code Extension to 5,000 Developers
Why it matters
Notify Cursor Marketplace users about the malicious extension and consider alternative distribution channels to preserve trust.
For product managers
For your product
What does this mean for your product?
Try it on your product More from this issueAll AI news from 3 Nov →
Get this every morning, written for your product.
Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.