Part of AI Developer Tools Security Crisis · 2 stories · since Oct 28 · newest 9d ago
Fake Claude Code Extension on Cursor Marketplace Backdoored Up to 5,000 DevelopersCursor CEO disputes that the 'official' extension was compromised
4 Oct 30 3:50 AM · 13d ago · 13 articles · 8 posts · 5 sources · development 4 of 8
Michael Truell pushes back on framing from an earlier post, saying Cursor does not believe the official Claude Code VS Code extension itself was compromised.
“We've spoken with the author of this blog and do not believe the official Claude Code VS Code extension was compromised. We believe this is instead a report of this incident.”
@mntruellAnthropic Maker of Claude CodeCursor (Anysphere) Operator of the compromised extension marketplaceMichael Truell Cursor CEO (@mntruell)Phorion Security research firm that discovered the backdoorKevin Beaumont (GossiTheDog) Security researcher
The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump
Reported in the same hours no headline names this development itself — these 1 claim were published in its stretch
-
first by OX Security, 13d ago · also Rescana, Step Security, Firstpost, Sophos, BleepingComputer, India Today
6 more headlines
- Trojanized Claude Code Extension 2.1.313 in Cursor Marketplace Plants SSH Backdoor Rescana · 13d ago
- Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines Step Security · 13d ago
- Cursor shuts down extension marketplace after malicious Claude Code puts 5,000 users at risk Firstpost · 13d ago
- Malicious Claude Code extension distributed through Cursor marketplace Sophos · 13d ago
- Malicious Claude Code extension on Cursor planted SSH backdoors BleepingComputer · 13d ago
- Cursor shuts down marketplace after malicious Claude Code extension hits 5,000 users, offers fix India Today · 13d ago
What people said 7 voices · verbatim
-
G
Anthropic got compromised. Their Claude Code extension on Visual Studio has malware in it, which creates a remote access Trojan to desktops. https:// phorion.io/blog/offical-claude -code-vsx-compromise/
-
@mattjay We've spoken with the author of this blog and do not believe the official Claude Code VS Code extension was compromised. We believe this is instead a report of this incident.
-
"Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on Open VSX that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up focuses primarily on macOS, where the extension attempts to configure an SSH backdoor and establish persistence. Organisations should immediately review their…
-
S
The official Claude Code extension for VS Code has been trojanized Check if you have the infected version with this PowerShell snippet: Get-ChildItem "$env:USERPROFILE\.vscode\extensions" -Directory -Filter "anthropic.claude-code-2.1.313*" | % FullName https:// opensourcemalware.com/blog/tro…
-
🔴 Cursor 下载的 Claude Code 插件 2.1.313 版本包含后门。请立即更新并清理系统环境。 - 文章称 Visual Studio Marketplace 和 OpenVSX 的插件不受影响。 - Cursor 用户请升级至 2.1.314 版本，并检查 SSH 公钥登录白名单配置及其它可能受影响之处。 - 此后门会收集系统信息并添加名为 svc-telemetry 的公钥到 authorized_keys。 - Cursor 称攻击者服务器已被关停。 [1] opensourcemalware.com/~ 1. cursor.com/~ #Cursor #Anthropic Telegram 原文
-
S
Claude Code extension for VS Code has been trojanized. Affected version anthropic.claude-code@2.1.313 https:// opensourcemalware.com/blog/tro janized-claude-code-extension-plants-persistent-ssh-backdoor
-
B
RE: https:// cyberplace.social/@GossiTheDog /117528831681803563 For wholesome uplifting content, everyone should follow @ GossiTheDog
All 8 developments of Fake Claude Code Extension on Cursor Marketplace Backdoored… →
MastodonHacker NewsNewswiresLobstersXGoogle NewsRedditBluesky