Malicious Claude extensions distributed via supply chain attack reached thousands of developer devices
MALWAREAnthropicredteam/daily · 2 sources
- Severity
- High
- Sources
- 2
What happened
A supply chain attack placed malicious Claude extensions on developer machines, with one malicious Claude Code extension served through Cursor. The extension performed host reconnaissance and attempted to create a reverse SSH tunnel, and flawed code reportedly prevented it from fully spreading to some 5,000 machines.
For IT people · Written by AI from 2 sources · Wrong?
What to do
- Check developer machines for the malicious Claude Code extension distributed through Cursor.
- Review devices for unexpected outbound SSH connections, as the extension attempted a reverse SSH tunnel.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
Wired (Security)SecurityWeek
Who and what is in it
Companies
Products