A trojanized Claude Code extension reached thousands of users in 11 hours. I built a verify-before-install gate for agent extensions.

A trojanized "Claude Code" extension served under the identifier Anthropic.claude-code 2.1.312/2.1.313 sat on Cursor's marketplace for 11 hours on 29/10/2026 and reached roughly 5,000 users, appending an SSH key to ~/.ssh/authorized_keys, opening a reverse tunnel and persisting on infected machines, according to a Dev.to report. The author released extverify, an MIT-licensed, zero-runtime-dependency command-line tool that returns ALLOW, DENY or REVIEW before an agent extension is installed, flagging signals such as publisher-name squatting, publishers under 30 days old, download-velocity anomalies and bundled executables. The author states that against the exact 29/10 attack shape — correct identifier, wrong bytes, one distribution path — listing-only checks produce REVIEW rather than a confident DENY, because Cursor's mirror has no public API to query.

A trojanized Claude Code extension reached thousands of users in 11 hours. I built a verify-before-install gate for agent extensions. On 29/10/2026, a trojanized "Claude Code" extension sat on Cursor's marketplace for 11 hours and reached roughly 5,000 users. The payload appended an SSH key to ~/.ssh/authorized keys, opened a reverse tunnel, and persisted on the machine. And the worst part: it did not even need typosquatting. It s erved wrong bytes under the right identifier Anthropic.claude-code 2.1.312/2.1.313 — on one distribution path only. A verified publisher badge would have passed it. Identity is not safety. I built extverify — verify-before-install for agent extensions. One command, one verdict ALLOW, DENY, or REVIEW before the extension lands in your editor. Local, deterministic, zero runtime dependencies. $ extverify verify anthr0pic.claude-code@2.1.313 recorded 29/10-shaped fixture DENY anthr0pic.claude-code@2.1.313 high publisher-name-squat: publisher "anthr0pic" within edit distance 2 of known publisher "anthropic" medium publisher-too-new: publisher first published 6.4 days ago < 30d low publisher-unverified: no verified domain badge high download-velocity-anomaly: 778 installs/day over 6.4d publisher age medium installs-no-ratings: 5000 installs with 0 ratings medium runs-on-startup: activationEvents includes " " code runs at every startup medium bundled-binary: vsix ships executable: extension/bin/svc-telemetry low single-registry: version not found on Open VSX — cross-registry hash comparison unavailable Against a well-known extension, the verdict is different — and honestly so: $ extverify verify esbenp.prettier-vscode live, real extension REVIEW esbenp.prettier-vscode@12.4.0 medium runs-on-startup: activationEvents includes "onStartupFinished" medium bundled-binary: vsix ships executable: extension/node modules/prettier/bin/prettier.cjs medium cross-registry-hash-mismatch: version 12.4.0 has different sha256 on VS Marketplace vs Open VSX — registries disagree, verify out-of-band before installing REVIEW means "here are the signals, you decide." There is also extverify pin <publisher.name@version — trust a specific version once; version-repackaged fires DENY if the bytes change under that same version later. I cannot query the Cursor mirror. There is no public API for it. Against the exact 29/10 attack shape — correct identifier, wrong bytes, served on one path — listing-only checks produce REVIEW, not a confident DENY. A hard DENY needs the typosquat/velocity shape or your own local pin. If someone tells you they catch everything pre-install, ask which distribution paths they actually query. mcp-audit audits extensions post-install. That is a different trade-off: it can run deeper dynamic checks extverify never attempts, at the cost of letting the code touch your machine first. Socket is SaaS with real dependency-graph analysis — deeper than listing signals, but it requires an account and trusting a vendor with your manifest. extverify runs on your machine, no account, no network dependency at verdict time. Registry takedowns are post-hoc by design: the 29/10 payload shipped for 11 hours before anyone reacted. Pre-install gates and post-install audits are complements, not substitutes. git clone https://github.com/techdevfun/extverify && cd extverify npm install && npm run build extverify verify <publisher.name MIT, zero runtime dependencies. The checks are all in the README with their severities and rationale. If you find a listing shape it misjudges, open an issue with the listing — that is the fastest way to make the next incident shorter than 11 hours. Key Takeaways - •A verified publisher badge would have passed it. - •This story was reported by Dev.to , covering developments in the dev space. - •AI advancements continue to reshape industries — read the full article on Dev.to for complete coverage. 📖 Continue reading the full article: Read Full Article on Dev.to → https://dev.to/techdevfun/a-trojanized-claude-code-extension-reached-thousands-of-users-in-11-hours-i-built-a-4ja7