Cursor has confirmed that malicious packages posing as Claude Code extensions were available through the VS Code Extension Marketplace for roughly 11 hours, and that the packages contained an SSH backdoor.
Cursor · VS Code Extension Marketplace
Fake Claude Code extensions carried an SSH backdoor
Cursor confirmed that malicious packages posing as Claude Code extensions were available on the VS Code Extension Marketplace for about 11 hours. The packages contained an SSH backdoor that could give an attacker remote access to a machine.
~11 h
Window during which the malicious packages were publicly available
SSH
Backdoor type, which can grant an attacker remote access to a machine
?
Number of users who installed the packages has not been disclosed
The exposure window, drawn to scale
Each block = one hour of public availability (11 blocks total)
Any developer who searched the marketplace in this window could have found and installed the packages.
Exposure ended once the malicious versions were removed. The article does not say how they were detected.
Confirmed
Malicious packages posed as Claude Code extensions
They were listed on the VS Code Extension Marketplace for about 11 hours
The packages contained an SSH backdoor
Cursor has acknowledged the incident
Not yet known
How many users installed the packages
How the malicious versions were detected and removed
The full scope of the compromise
What steps were taken to protect affected users
If you installed a Claude Code-related extension
Check your extensions and your machine before assuming you are clear.
1. Review extensions
Look for unfamiliar publishers among installed extensions.
2. Inspect SSH keys
Look for SSH keys you do not recognize.
3. Check remote access
Review remote access configurations for unexpected entries.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...