conv.

← The whole story
Security

Part of AI Developer Tools Security Crisis · 2 stories · since Oct 28 · newest 8d ago

Fake Claude Code Extension on Cursor Marketplace Backdoored Up to 5,000 Developers

Phorion publishes backdoor discovery; Cursor pulls the versions

2 Oct 30 3:09 AM · 12d ago · 2 articles · 4 posts · 4 sources · development 2 of 8

Security firm Phorion details an injected payload that writes an attacker Ed25519 key to authorized_keys, sets up persistence, and beacons host recon data, across macOS, Linux and Windows; Cursor removes 2.1.312/2.1.313.

Phorion publishes backdoor discovery; Cursor pulls the versions
arstechnica.com

“Phorion has discovered a compromise of the official Claude Code for VS Code extension on the Cursor Marketplace, where the backdoored extension bundle contains a persistent Secure Shell (SSH) backdoor.”

Phorion

Anthropic Maker of Claude CodeCursor (Anysphere) Operator of the compromised extension marketplaceMichael Truell Cursor CEO (@mntruell)Phorion Security research firm that discovered the backdoorKevin Beaumont (GossiTheDog) Security researcher

The whole story articlespostscomments the bright band is this development · numbered dots are the others · click one to jump

Peak 66 pieces in 4h at Oct 30, 5 AM; 231 pieces over 14 days (52 articles · 85 posts · 94 comments) Oct 28, 1 PM — 1 piece · 1 post — Mastodon 1Oct 28, 5 PM — quietOct 28, 9 PM — quietOct 29, 1 AM — quietOct 29, 5 AM — quietOct 29, 9 AM — quietOct 29, 1 PM — quietOct 29, 5 PM — quietOct 29, 9 PM — 2 pieces · 2 posts — Hacker News 1, X 1Oct 30, 1 AM — 27 pieces · 15 articles · 12 posts — Google News 12, Mastodon 8, Newswires 3, +2 moreOct 30, 5 AM — 66 pieces · 8 articles · 23 posts · 35 comments — Hacker News 28, Mastodon 20, Lobsters 11, +2 moreOct 30, 9 AM — 54 pieces · 1 article · 15 posts · 38 comments — Lobsters 20, Hacker News 19, Mastodon 11, +2 moreOct 30, 1 PM — 25 pieces · 5 articles · 8 posts · 12 comments — Mastodon 8, Lobsters 7, Hacker News 6, +2 moreOct 30, 5 PM — 7 pieces · 2 articles · 2 posts · 3 comments — Mastodon 2, Hacker News 2, Google News 1, +2 moreOct 30, 9 PM — 19 pieces · 14 articles · 3 posts · 2 comments — Newswires 14, Lobsters 1, Mastodon 1, +3 moreOct 31, 1 AM — 5 pieces · 1 article · 2 posts · 2 comments — Hacker News 2, Reddit 1, X 1, +1 moreOct 31, 5 AM — 3 pieces · 1 article · 2 posts — Mastodon 2, Google News 1Oct 31, 9 AM — quietOct 31, 1 PM — 2 pieces · 2 posts — Mastodon 2Oct 31, 5 PM — 2 pieces · 2 posts — Bluesky 2Oct 31, 9 PM — 2 pieces · 2 posts — Bluesky 1, Mastodon 1Nov 1, 1 AM — 4 pieces · 1 article · 1 post · 2 comments — Lobsters 2, Google News 1, Mastodon 1Nov 1, 4 AM — 2 pieces · 2 posts — Bluesky 2Nov 1, 8 AM — quietNov 1, 12 PM — 2 pieces · 2 articles — Google News 1, Mastodon 1Nov 1, 4 PM — quietNov 1, 8 PM — 2 pieces · 2 posts — Hacker News 1, Mastodon 1Nov 2, 12 AM — 1 piece · 1 post — Mastodon 1Nov 2, 4 AM — 2 pieces · 2 articles — Google News 1, Newswires 1Nov 2, 8 AM — 1 piece · 1 post — Bluesky 1Nov 2, 12 PM — quietNov 2, 4 PM — quietNov 2, 8 PM — 1 piece · 1 post — Bluesky 1Nov 3, 12 AM — quietNov 3, 4 AM — quietNov 3, 8 AM — quietNov 3, 12 PM — quietNov 3, 4 PM — quietNov 3, 8 PM — quietNov 4, 12 AM — 1 piece · 1 post — Mastodon 1Nov 4, 4 AM — quietNov 4, 8 AM — quietNov 4, 12 PM — quietNov 4, 4 PM — quietNov 4, 8 PM — quietNov 5, 12 AM — quietNov 5, 4 AM — quietNov 5, 8 AM — quietNov 5, 12 PM — quietNov 5, 4 PM — quietNov 5, 8 PM — quietNov 6, 12 AM — quietNov 6, 4 AM — quietNov 6, 8 AM — quietNov 6, 12 PM — quietNov 6, 4 PM — quietNov 6, 8 PM — quietNov 7, 12 AM — quietNov 7, 4 AM — quietNov 7, 8 AM — quietNov 7, 12 PM — quietNov 7, 4 PM — quietNov 7, 8 PM — quietNov 8, 12 AM — quietNov 8, 4 AM — quietNov 8, 8 AM — quietNov 8, 12 PM — quietNov 8, 4 PM — quietNov 8, 8 PM — quietNov 9, 12 AM — quietNov 9, 4 AM — quietNov 9, 8 AM — quietNov 9, 12 PM — quietNov 9, 4 PM — quietNov 9, 8 PM — quietYesterday, 12 AM — quietYesterday, 4 AM — quietYesterday, 8 AM — quietYesterday, 12 PM — quietYesterday, 4 PM — quietYesterday, 8 PM — quietToday, 12 AM — quietToday, 4 AM — quietToday, 8 AM — quietToday, 12 PM — quietToday, 4 PM — quietToday, 8 PM — quiet 12–78
1Malicious extension circulates on…2–7Phorion publishes backdoor discovery…8Microsoft publishes technical postmortem…
Oct 29Oct 31Nov 2Nov 4Nov 6Nov 8now · 10:25 PM ET

Reported in the same hours no headline names this development itself — these 1 claim were published in its stretch

  1. 2 outlets Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

    first by HN Best, 12d ago · also HN Frontpage

    1 more headline

What people said 2 voices · verbatim

All 8 developments of Fake Claude Code Extension on Cursor Marketplace Backdoored… →

MastodonHacker NewsNewswiresLobstersXGoogle NewsRedditBluesky