Trojanised Claude Extension: The Supply Chain Risk Hiding in Developer Tools

A supply chain attack targeting developers using the Cursor AI-powered integrated development environment resulted in a malicious extension, branded to resemble a legitimate Claude Code tool, being installed on approximately 5,000 developer machines. Wired reports that a flaw in the attacker's own code prevented the payload from fully executing on many affected systems, limiting the overall impact. However, Microsoft's Security Blog published a detailed technical analysis confirming that the extension installed a persistent SSH backdoor, designed to give attackers ongoing remote access to compromised developer workstations. Dark Reading noted that two separate security issues affecting Cursor emerged on the same day, highlighting the broader risk environment surrounding AI-powered development tools and their extension ecosystems.

Why this matters for UK organisations

Developer machines are among the most sensitive endpoints in any organisation. They typically hold source code, API keys, cloud service credentials, access tokens, and direct connections to internal repositories and CI/CD pipelines. A persistent backdoor on a developer workstation does not just affect that individual machine; it can provide a foothold that reaches into production environments, customer data systems, and the broader software supply chain. The use of a trusted and recognisable brand name, Claude Code, to disguise the malicious extension is a well-established social engineering technique applied to a modern context. As AI coding assistants become standard tools in development workflows, the extension and plugin ecosystems that surround them represent an expanding and often under-scrutinised attack surface. For UK software development teams and technology businesses, this incident is a direct illustration of that risk.

What to review

Organisations should audit the extensions and plugins currently installed across developer workstations, with particular attention to AI coding tools and IDE extensions sourced from public marketplaces. Controls around what developers are permitted to install, and from which sources, should be reviewed and documented. Developer machines should be confirmed as within scope for endpoint detection and response coverage, as they are frequently treated differently from standard employee devices. Where SSH access is in use, review whether persistent or unexpected SSH configurations exist on developer endpoints. Microsoft's Security Blog provides technical indicators and remediation guidance that security teams can use to assess whether any devices in their environment may have been affected.

Source: Wired Security