Trojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines

Researchers found that anthropic.claude-code version 2.1.313, obtained from Open VSX, had 66 lines of malicious JavaScript added to the legitimate extension bundle. The loader runs before the extension's normal code and sets up persistent SSH access to infected hosts. The issue has been traced to a compromise of the Cursor Marketplace, and Cursor briefly took the service down to remove the malware.

For IT people · Written by AI from 2 sources · Wrong?