Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Tuesday 3 November
Global

Your region, kept on this device.

Get the appSign in

Malware · 3 sources · latest 2d

Tampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces

Severity
High
Sources
3

What happened

Phorion researchers found that extension version 2.1.313 was tampered with and published on Open VSX, the Eclipse Foundation's open-source marketplace for -compatible editors. BleepingComputer reports it was distributed through 's extension marketplace for about 11 hours on October 29, exposing up to 5,000 developers to malware that installs persistent SSH backdoors. 's Visual Studio Marketplace never carried the compromised build.

For IT people · Written by AI from 3 sources · Wrong?

What to do

  1. Keep devices updated and install software only from official stores or the maker’s site.

General advice for this kind of story

Read the full story at the source

Full story timeline · 3 updates

  1. Fri 30 OctoberClaude Code extension poisoned with persistent SSH backdoorHelp Net Security
  2. Malicious Claude Code extension on Cursor planted SSH backdoorsBleepingComputer
  3. Sat 31 OctoberInside a malicious Claude Code-branded extension and its persistent SSH backdoorMicrosoft Security Blog

Who reported · 3 outlets

Help Net SecurityBleepingComputerMicrosoft Security Blog

Who and what is in it

Companies

AnthropicMicrosoft

Products

Claude CodeCursorVS Code

Report a problem