Malicious Claude extensions distributed via supply chain attack reached thousands of developer devices
MALWAREAnthropicredteam/daily · 2 sources
- Severity
- High
- Sources
- 2
What happened
A supply chain attack distributed malicious Claude extensions, including a Claude Code extension served through the Cursor ecosystem. The payload performed host reconnaissance and attempted to establish a reverse SSH tunnel, providing remote access. Per Wired, a bug in the malicious code stopped the worm-like spread to around 5,000 developer machines. The articles give no CVE IDs, affected versions or IOCs. Defenders should audit developer workstations for these extensions, review outbound SSH connections, and check extension sources and integrity.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Check developer machines for the malicious Claude Code extension distributed through Cursor.
- Review devices for unexpected outbound SSH connections, as the extension attempted a reverse SSH tunnel.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
Wired (Security)SecurityWeek
Who and what is in it
Companies
Products