Tampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces

Phorion identified a trojanised Claude Code extension, version 2.1.313, on Open VSX that plants a persistent SSH backdoor on developer machines. BleepingComputer reports it was served via Cursor's marketplace for roughly 11 hours on October 29, with exposure of up to 5,000 developers. The articles give no CVE IDs, no details of how the package was tampered with, and no remediation steps. Defenders using VS Code-compatible editors should check whether version 2.1.313 was installed and review affected hosts for unexpected SSH access. Microsoft's Visual Studio Marketplace was not affected.

For security analysts · Written by AI from 2 sources · Wrong?