Trojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
MALWAREAnthropicredteam/daily · 2 sources
- Severity
- High
- Sources
- 2
What happened
A tampered version of the Claude Code add-on for code editors was found on a public extension store. It secretly gave attackers a lasting way to log in remotely to developers' computers. The problem was traced to a compromise of the Cursor Marketplace, and Cursor briefly took the service offline to remove the malware.
Like I’m new · Written by AI from 2 sources · Wrong?
What to do
- Keep devices updated and install software only from official stores or the maker’s site.
General advice for this kind of story
Full story timeline · 4 updates
- Fri 30 OctoberMalicious Claude Code VS Code Extension Installs Persistent SSH Backdoor to Give Attackers Remote AccessGBHackers
- Official Claude Code VS Code Extension Compromised to Install Persistent SSH BackdoorThe Hacker News
- Sat 31 OctoberHackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH BackdoorGBHackers
- Mon 2 NovemberMalicious Claude Code Extensions in Cursor Marketplace Install Persistent SSH Backdoors on Windows and macOSGBHackers
Who reported · 2 outlets
GBHackersThe Hacker News
Who and what is in it
Products