GoKawiilFake Claude Code extension on Cursor marketplace installed SSH backdoors
A tampered version of Anthropic's Claude Code VS Code extension, labeled version 2.1.313, was available on Cursor's extension marketplace for about 11 hours on October 29, reaching as many as 5,000 developers. Security researchers at Phorion and OpenSourceMalware found the attackers inserted malicious JavaScript into the extension's main file that ran automatically on load, without any user interaction with Claude Code.