Security researcher Kevin Beaumont, who writes under the handle doublepulsar, published an analysis describing the discovery of a modified version of the Claude Code extension for Visual Studio Code that contained a remote access trojan. This tampered package was reportedly uploaded to the marketplace used by Cursor, a VS Code-based editor widely adopted by developers working with AI coding assistants.
Contrary to what the framing might suggest, this does not appear to be a direct breach of Anthropic's own infrastructure, but rather a software supply-chain attack exploiting the open nature of extension marketplaces. Anyone can publish a package under a name closely resembling a legitimate product, in this case Claude Code, hoping to mislead developers who do not carefully verify the publisher's identity before installing.
According to the report, developers who installed the fraudulent extension risked executing malicious code capable of establishing persistent remote access to their machine. Such access can enable exfiltration of source code, environment secrets, authentication tokens, or cloud credentials, all of which are sensitive assets on professional development workstations.
The incident fits a broader pattern of supply-chain attacks targeting AI-assisted coding tools, following earlier cases involving malicious npm packages or extensions mimicking popular assistants. The growing adoption of Claude Code and similar tools makes them attractive targets for attackers seeking to compromise developers who often hold privileged access to critical infrastructure.
The case underscores the importance of carefully verifying publisher identity before installing extensions, and highlights the need for marketplace operators to strengthen vetting and code-signing mechanisms against a still under-monitored attack vector.