{"slug": "a-trojanized-claude-code-extension-reached-thousands-of-users-in-11-hours-i-a", "title": "A trojanized Claude Code extension reached thousands of users in 11 hours. I built a verify-before-install gate for agent extensions.", "summary": "A trojanized \"Claude Code\" extension served under the identifier Anthropic.claude-code 2.1.312/2.1.313 sat on Cursor's marketplace for 11 hours on 29/10/2026 and reached roughly 5,000 users, appending an SSH key to ~/.ssh/authorized_keys, opening a reverse tunnel and persisting on infected machines, according to a Dev.to report. The author released extverify, an MIT-licensed, zero-runtime-dependency command-line tool that returns ALLOW, DENY or REVIEW before an agent extension is installed, flagging signals such as publisher-name squatting, publishers under 30 days old, download-velocity anomalies and bundled executables. The author states that against the exact 29/10 attack shape — correct identifier, wrong bytes, one distribution path — listing-only checks produce REVIEW rather than a confident DENY, because Cursor's mirror has no public API to query.", "body_md": "# A trojanized Claude Code extension reached thousands of users in 11 hours. I built a verify-before-install gate for agent extensions.\n\nOn 29/10/2026, a trojanized \"Claude Code\" extension sat on Cursor's marketplace for 11 hours and reached roughly 5,000 users. The payload appended an SSH key to ~/.ssh/authorized_keys, opened a reverse tunnel, and persisted on the machine. And the worst part: it did not even need typosquatting. It s\n\nerved wrong bytes under the right identifier (Anthropic.claude-code 2.1.312/2.1.313) — on one distribution path only. A verified publisher badge would have passed it. Identity is not safety. I built extverify — verify-before-install for agent extensions.\n\nOne command, one verdict (ALLOW, DENY, or REVIEW) before the extension lands in your editor. Local, deterministic, zero runtime dependencies. $ extverify verify anthr0pic.claude-code@2.1.313 # recorded 29/10-shaped fixture DENY anthr0pic.claude-code@2.1.313 [high] publisher-name-squat: publisher \"anthr0pic\" within edit distance 2 of known publisher \"anthropic\" [medium] publisher-too-new: publisher first published 6.4 days ago (< 30d) [low] publisher-unverified: no verified domain badge [high] download-velocity-anomaly: 778 installs/day over 6.4d publisher age [medium] installs-no-ratings: 5000 installs with 0 ratings [medium] runs-on-startup: activationEvents includes \"*\" (code runs at every startup) [medium] bundled-binary: vsix ships executable: extension/bin/svc-telemetry [low] single-registry: version not found on Open VSX — cross-registry hash comparison unavailable Against a well-known extension, the verdict is different — and honestly so: $ extverify verify esbenp.prettier-vscode # live, real extension REVIEW esbenp.prettier-vscode@12.4.0 [medium] runs-on-startup: activationEvents includes \"onStartupFinished\" [medium] bundled-binary: vsix ships executable: extension/node_modules/prettier/bin/prettier.cjs [medium] cross-registry-hash-mismatch: version 12.4.0 has different sha256 on VS Marketplace vs Open VSX — registries disagree, verify out-of-band before installing REVIEW means \"here are the signals, you decide.\" There is also extverify pin <publisher.name@version> — trust a specific version once; version-repackaged fires DENY if the bytes change under that same version later. I cannot query the Cursor mirror.\n\nThere is no public API for it. Against the exact 29/10 attack shape — correct identifier, wrong bytes, served on one path — listing-only checks produce REVIEW, not a confident DENY. A hard DENY needs the typosquat/velocity shape or your own local pin. If someone tells you they catch everything pre-install, ask which distribution paths they actually query.\n\nmcp-audit audits extensions post-install. That is a different trade-off: it can run deeper dynamic checks extverify never attempts, at the cost of letting the code touch your machine first. Socket is SaaS with real dependency-graph analysis — deeper than listing signals, but it requires an account and trusting a vendor with your manifest. extverify runs on your machine, no account, no network dependency at verdict time.\n\nRegistry takedowns are post-hoc by design: the 29/10 payload shipped for 11 hours before anyone reacted. Pre-install gates and post-install audits are complements, not substitutes. git clone https://github.com/techdevfun/extverify && cd extverify npm install && npm run build extverify verify <publisher.name> MIT, zero runtime dependencies. The checks are all in the README with their severities and rationale.\n\nIf you find a listing shape it misjudges, open an issue with the listing — that is the fastest way to make the next incident shorter than 11 hours.\n\n## Key Takeaways\n\n- •A verified publisher badge would have passed it.\n- •This story was reported by **Dev.to** , covering developments in the**dev** space.\n- •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage.\n\n📖 Continue reading the full article:\n\n[Read Full Article on Dev.to →](https://dev.to/techdevfun/a-trojanized-claude-code-extension-reached-thousands-of-users-in-11-hours-i-built-a-4ja7)", "url": "https://wpnews.pro/news/a-trojanized-claude-code-extension-reached-thousands-of-users-in-11-hours-i-a", "canonical_source": "https://ainexusdaily.vercel.app/article/2026-11-04-a-trojanized-claude-code-extension-reached-thousands-of-users-in-11-hours-i-buil", "published_at": "2026-11-04 13:31:57+00:00", "updated_at": "2026-11-04 13:49:47.098327+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools", "ai-tools"], "entities": ["Claude Code", "Cursor", "Anthropic", "extverify", "Open VSX", "VS Marketplace", "mcp-audit", "Socket"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/a-trojanized-claude-code-extension-reached-thousands-of-users-in-11-hours-i-a", "markdown": "https://wpnews.pro/news/a-trojanized-claude-code-extension-reached-thousands-of-users-in-11-hours-i-a.md", "text": "https://wpnews.pro/news/a-trojanized-claude-code-extension-reached-thousands-of-users-in-11-hours-i-a.txt", "jsonld": "https://wpnews.pro/news/a-trojanized-claude-code-extension-reached-thousands-of-users-in-11-hours-i-a.jsonld"}}