Malware · 3 sources · latest 3d

Tampered Claude Code extension spread SSH backdoor via Open VSX and Cursor marketplaces

MALWAREAnthropicredteam/daily · 3 sources

Severity: High
Sources: 3

What happened

A fake, tampered version of Anthropic's Claude Code add-on for code editors was made available for download and could let attackers secretly connect to developers' computers. Reports say it was online for around 11 hours and may have reached up to 5,000 developers. Microsoft's own extension store never carried the bad version.

Like I’m new · Written by AI from 3 sources · Wrong?

What to do

Keep devices updated and install software only from official stores or the maker’s site.

General advice for this kind of story

Read the full story at the source

Full story timeline · 3 updates

Fri 30 October11:15Claude Code extension poisoned with persistent SSH backdoorHelp Net Security
14:36Malicious Claude Code extension on Cursor planted SSH backdoorsBleepingComputer
Sat 31 October01:02Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMicrosoft Security Blog

Who reported · 3 outlets

Help Net SecurityBleepingComputerMicrosoft Security Blog

Who and what is in it

Companies

Anthropic Microsoft

Products

Claude Code Cursor VS Code