Tampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces
MALWAREAnthropicredteam/daily · 3 sources
- Severity
- High
- Sources
- 3
What happened
Phorion identified a trojanised Claude Code extension, version 2.1.313, on Open VSX that plants a persistent SSH backdoor on developer machines. BleepingComputer reports it was served via Cursor's marketplace for roughly 11 hours on October 29, with exposure of up to 5,000 developers. The articles give no CVE IDs, no details of how the package was tampered with, and no remediation steps. Defenders using VS Code-compatible editors should check whether version 2.1.313 was installed and review affected hosts for unexpected SSH access. Microsoft's Visual Studio Marketplace was not affected.
For security analysts · Written by AI from 3 sources · Wrong?
What to do
- Keep devices updated and install software only from official stores or the maker’s site.
General advice for this kind of story
Full story timeline · 3 updates
Who reported · 3 outlets
Help Net SecurityBleepingComputerMicrosoft Security Blog
Who and what is in it
Products