conv.

← The whole story
Security

Part of AI Developer Tools Security Crisis · 2 stories · since Oct 28 · newest 8d ago

Fake Claude Code Extension on Cursor Marketplace Backdoored Up to 5,000 Developers

Malicious extension circulates on Cursor's marketplace for ~11-12 hours

1 Oct 29 · 13d ago · 1 post · 1 source · development 1 of 8

Versions 2.1.312 and 2.1.313 of the Claude Code VS Code extension, modified to include a backdoor, were served through the Cursor Marketplace before being pulled.

Malicious extension circulates on Cursor's marketplace for ~11-12 hours
arstechnica.com

Anthropic Maker of Claude CodeCursor (Anysphere) Operator of the compromised extension marketplaceMichael Truell Cursor CEO (@mntruell)Phorion Security research firm that discovered the backdoorKevin Beaumont (GossiTheDog) Security researcher

The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump

Peak 65 pieces in 4h at Oct 30, 5 AM; 231 pieces over 14 days (52 articles · 85 posts · 94 comments) Oct 28, 1 PM — 1 piece · 1 post — Mastodon 1Oct 28, 5 PM — quietOct 28, 9 PM — quietOct 29, 1 AM — quietOct 29, 5 AM — quietOct 29, 9 AM — quietOct 29, 1 PM — quietOct 29, 5 PM — quietOct 29, 9 PM — 2 pieces · 2 posts — Hacker News 1, X 1Oct 30, 1 AM — 27 pieces · 15 articles · 12 posts — Google News 12, Mastodon 8, Newswires 3, +2 moreOct 30, 5 AM — 65 pieces · 8 articles · 23 posts · 34 comments — Hacker News 28, Mastodon 20, Lobsters 10, +2 moreOct 30, 9 AM — 55 pieces · 1 article · 15 posts · 39 comments — Lobsters 21, Hacker News 19, Mastodon 11, +2 moreOct 30, 1 PM — 25 pieces · 5 articles · 8 posts · 12 comments — Mastodon 8, Lobsters 7, Hacker News 6, +2 moreOct 30, 5 PM — 7 pieces · 2 articles · 2 posts · 3 comments — Mastodon 2, Hacker News 2, Google News 1, +2 moreOct 30, 9 PM — 19 pieces · 14 articles · 3 posts · 2 comments — Newswires 14, Lobsters 1, Mastodon 1, +3 moreOct 31, 1 AM — 5 pieces · 1 article · 2 posts · 2 comments — Hacker News 2, Reddit 1, X 1, +1 moreOct 31, 5 AM — 2 pieces · 2 posts — Mastodon 2Oct 31, 9 AM — 1 piece · 1 article — Google News 1Oct 31, 1 PM — 2 pieces · 2 posts — Mastodon 2Oct 31, 5 PM — 2 pieces · 2 posts — Bluesky 2Oct 31, 9 PM — 2 pieces · 2 posts — Bluesky 1, Mastodon 1Nov 1, 1 AM — 4 pieces · 1 article · 1 post · 2 comments — Lobsters 2, Google News 1, Mastodon 1Nov 1, 4 AM — 2 pieces · 2 posts — Bluesky 2Nov 1, 8 AM — quietNov 1, 12 PM — 2 pieces · 2 articles — Google News 1, Mastodon 1Nov 1, 4 PM — quietNov 1, 8 PM — 2 pieces · 2 posts — Hacker News 1, Mastodon 1Nov 2, 12 AM — 1 piece · 1 post — Mastodon 1Nov 2, 4 AM — 2 pieces · 2 articles — Google News 1, Newswires 1Nov 2, 8 AM — 1 piece · 1 post — Bluesky 1Nov 2, 12 PM — quietNov 2, 4 PM — quietNov 2, 8 PM — 1 piece · 1 post — Bluesky 1Nov 3, 12 AM — quietNov 3, 4 AM — quietNov 3, 8 AM — quietNov 3, 12 PM — quietNov 3, 4 PM — quietNov 3, 8 PM — quietNov 4, 12 AM — 1 piece · 1 post — Mastodon 1Nov 4, 4 AM — quietNov 4, 8 AM — quietNov 4, 12 PM — quietNov 4, 4 PM — quietNov 4, 8 PM — quietNov 5, 12 AM — quietNov 5, 4 AM — quietNov 5, 8 AM — quietNov 5, 12 PM — quietNov 5, 4 PM — quietNov 5, 8 PM — quietNov 6, 12 AM — quietNov 6, 4 AM — quietNov 6, 8 AM — quietNov 6, 12 PM — quietNov 6, 4 PM — quietNov 6, 8 PM — quietNov 7, 12 AM — quietNov 7, 4 AM — quietNov 7, 8 AM — quietNov 7, 12 PM — quietNov 7, 4 PM — quietNov 7, 8 PM — quietNov 8, 12 AM — quietNov 8, 4 AM — quietNov 8, 8 AM — quietNov 8, 12 PM — quietNov 8, 4 PM — quietNov 8, 8 PM — quietNov 9, 12 AM — quietNov 9, 4 AM — quietNov 9, 8 AM — quietNov 9, 12 PM — quietNov 9, 4 PM — quietNov 9, 8 PM — quietYesterday, 12 AM — quietYesterday, 4 AM — quietYesterday, 8 AM — quietYesterday, 12 PM — quietYesterday, 4 PM — quietYesterday, 8 PM — quietToday, 12 AM — quietToday, 4 AM — quietToday, 8 AM — quietToday, 12 PM — quietToday, 4 PM — quietToday, 8 PM — quiet 12–78
1Malicious extension circulates on…2–7Ars Technica reports backdoor was live…8Microsoft publishes technical postmortem…
Oct 29Oct 31Nov 2Nov 4Nov 6Nov 8now · 10:23 PM ET

What was reported 6 claims about this development

  1. 7 outlets Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension

    first by Unite.AI, 11d ago · also RuntimeWire, The Hacker News, Help Net Security, The Register, Notebookcheck, Northeast Times

    8 more headlines
  2. 7 outlets Compromised Claude Code Extension (2.1.313) in Cursor Marketplace Plants Attacker SSH Key and Persistence

    first by OX Security, 12d ago · also Rescana, Step Security, Firstpost, Sophos, BleepingComputer, India Today

    6 more headlines
  3. 2 outlets Anthropic VS code extension on Cursor backdoored for nearly 12 hours

    first by Ars Technica, 11d ago · also Cursor

    1 more headline
  4. 2 outlets Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

    first by HN Best, 12d ago · also HN Frontpage

    1 more headline
  5. 1 outlet Malicious Claude Code Extension Reached Cursor Marketplace, Exposing Up To 5,000 Users

    first by The 420.in, 12d ago

  6. 1 outlet Cursor warns of malicious extension affecting up to 5,000 users

    first by YourStory.com, 12d ago

What people said 1 voice · verbatim

All 8 developments of Fake Claude Code Extension on Cursor Marketplace Backdoored… →

MastodonHacker NewsNewswiresLobstersXGoogle NewsRedditBluesky