How a Trojanized 'Claude Code' Extension on Cursor Targeted 5,000 Developers (Verification Commands)

Imagine updating a seemingly innocent extension in Cursor, only to have an attacker's SSH public key silently appended to your ~/.ssh/authorized_keys file in the background.

In a recent supply-chain incident on the Cursor Extension Marketplace, trojanized versions (2.1.312 and 2.1.313) of an extension masquerading as claude-code remained live for roughly 11 hours, reaching up to 5,000 developer machines.

1. How the Attack Worked (Why IDE Extensions Run Without a Sandbox)

Unlike browser extensions, VS Code and Cursor extensions run with full user privileges:

1. SSH Key Injection: The payload attempted to append an attacker-controlled SSH key into ~/.ssh/authorized_keys.
2. Persistence: It tried to register a persistent background job (~/Library/LaunchAgents on macOS or Scheduled Tasks on Windows) to open a Reverse SSH Tunnel.

2. One-Line Terminal Commands to Audit Your Machine

macOS & Linux

# 1. Check installed Cursor extensions for claude-code
ls -la ~/.cursor/extensions/ | grep -i "claude"
 
# 2. Inspect your SSH authorized_keys for unknown keys
cat ~/.ssh/authorized_keys
 
# 3. Check macOS LaunchAgents for unfamiliar plist files
ls -la ~/Library/LaunchAgents/

Windows (PowerShell)

Get-ChildItem "$env:USERPROFILE\.cursor\extensions" -Filter "*claude*"
if (Test-Path "$env:USERPROFILE\.ssh\authorized_keys") { Get-Content "$env:USERPROFILE\.ssh\authorized_keys" }

To prevent silent supply-chain updates in the future, disable automatic extension updates in your settings.json:

{
  "extensions.autoUpdate": false,
  "extensions.autoCheckUpdates": true
}