Security researchers have warned that a tampered coding extension reached as many as 5,000 developers through a third-party marketplace this week. The compromised Claude Code extension, distributed via the Cursor marketplace, reportedly installed persistent remote-access mechanisms on machines that installed it, prompting urgent calls for affected users to check their systems.
What researchers found in the tampered coding extension
According to the analysis published by security firm StepSecurity, the altered extension, version 2.1.313, appeared on the marketplace on 29 October and behaved differently from the genuine release. Instead of simply helping developers write and edit code with AI assistance, the tampered package quietly set up ways for an attacker to reconnect to the machine later. Anthropic has clarified that its own systems and official distribution channels were not compromised, a distinction that matters for where the blame, and the fix, should fall. We cover developer security regularly in our technology coverage.
Why supply-chain attacks keep working
Developers install extensions with deep access to their code, terminals and credentials, often with a single click and little scrutiny. That makes marketplaces attractive targets: compromise one popular package and you inherit the trust of thousands of users. As today’s AI news digest explains, the incident is a textbook software supply-chain attack, and it echoes earlier cases in which malicious packages slipped into open-source repositories.
What developers should do now
The practical advice is unglamorous but effective: verify the publisher and version of every extension installed, remove the affected release immediately, rotate any credentials the machine could access, and prefer official marketplaces and signed releases. Teams should also pin extension versions in shared development environments so one person’s install cannot silently change everyone’s tooling.
AI coding tools are becoming part of the basic infrastructure of software development. Incidents like this one show that the security habits around them have to mature just as fast, because the blast radius of a single tampered plugin now reaches deep into company networks.
