---
title: "Malicious Claude Code Extension Served in Cursor Supply Chain Attack"
type: signal
url: https://frontiernewswire.com/s/malicious-claude-code-extension-served-in-cursor-supply-chain-attack-d3db24b3
published: 2026-11-02T11:29:39.000Z
byline: "Source: SecurityWeek"
---

# Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Source: SecurityWeek · Published 2026-11-02 · Canonical: https://frontiernewswire.com/s/malicious-claude-code-extension-served-in-cursor-supply-chain-attack-d3db24b3

The extension performed host reconnaissance and attempted to create a reverse SSH tunnel. The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek .

In this story: [Claude Code](https://frontiernewswire.com/models/claude-code), [Cursor](https://frontiernewswire.com/models/cursor), [AI security](https://frontiernewswire.com/topics/ai-security)

## Sources

- [Read the original at SecurityWeek](https://www.securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack)

## On Bluesky

- [@ninjaintelgroup.bsky.social](https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mzdahotcqm2i) (Nov 2, 2026 · 1 like): 🗞 Malicious Claude Code Extension Served in Cursor Supply Chain Attack via SecurityWeek https://www.securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack/ \#cybersecurity \#infosec \#threatintel

## Related on Frontier

- [Cursor removes malicious Claude Code extension after SSH backdoor attempt](https://frontiernewswire.com/s/cursor-removes-malicious-claude-code-extension-after-ssh-backdoor-2596eaf1)
- [Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor](https://frontiernewswire.com/s/official-claude-code-vs-code-extension-compromised-to-install-d53c08b0)
- [Devs Hit by Trojanized Claude Code Extension for Cursor](https://frontiernewswire.com/s/devs-hit-by-trojanized-claude-code-extension-for-cursor-2e3ddd3c)
- [Anthropic says a malicious actor used access to Cursor's marketplace to publish a "tampered" copy of the Claude Code extension, which it didn't build or publish (Felix Rieseberg/@felixrieseberg)](https://frontiernewswire.com/s/anthropic-says-a-malicious-actor-used-access-to-cursors-marketplace-to-45e77194)
- [DeepSeek Drops Enhanced Coding Agent With Aim to Rival Anthropic](https://frontiernewswire.com/s/deepseek-drops-enhanced-coding-agent-with-aim-to-rival-anthropic-817b652f)

---

[More Latest Signal](https://frontiernewswire.com/) · [Signals](https://frontiernewswire.com/verified-reporting)