Sign inGet the app

Malware · 2 sources · latest 6h

Tampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces

Severity
High
Sources
2

What happened

Phorion researchers found that Claude Code extension version 2.1.313 was tampered with and published on Open VSX, the Eclipse Foundation's open-source marketplace for VS Code-compatible editors. BleepingComputer reports it was distributed through Cursor's extension marketplace for about 11 hours on October 29, exposing up to 5,000 developers to malware that installs persistent SSH backdoors. Microsoft's Visual Studio Marketplace never carried the compromised build.

For IT people · Written by AI from 2 sources · Wrong?

Read the full story at the sourceAsk about this story

Full story timeline · 2 updates

  1. Fri 30 OctoberClaude Code extension poisoned with persistent SSH backdoorHelp Net Security
  2. Malicious Claude Code extension on Cursor planted SSH backdoorsBleepingComputer

Who reported · 2 outlets

Help Net SecurityBleepingComputer

Report a problem