Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor…
Hnrss.Org 8 versions
-
1 new sentence, beginning: “Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 932 # Comments: 537”
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
https://cursor.com/blog/claude-code-extension-security-notic... Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 932 # Comments: 537
-
1 new sentence, beginning: “Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 911 # Comments: 534”
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
https://cursor.com/blog/claude-code-extension-security-notic... Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 911 # Comments: 534
-
1 new sentence, beginning: “Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 884 # Comments: 522”
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
https://cursor.com/blog/claude-code-extension-security-notic... Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 884 # Comments: 522
-
1 new sentence, beginning: “Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 858 # Comments: 512”
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
https://cursor.com/blog/claude-code-extension-security-notic... Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 858 # Comments: 512
-
1 new sentence, beginning: “Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 799 # Comments: 500”
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
https://cursor.com/blog/claude-code-extension-security-notic... Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 799 # Comments: 500
-
1 new sentence, beginning: “Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 740 # Comments: 462”
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
https://cursor.com/blog/claude-code-extension-security-notic... Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 740 # Comments: 462
-
1 new sentence, beginning: “Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 621 # Comments: 417”
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
https://cursor.com/blog/claude-code-extension-security-notic... Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 621 # Comments: 417
-
Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
https://cursor.com/blog/claude-code-extension-security-notic... Comments URL: https://news.ycombinator.com/item?id=50300683 Points: 454 # Comments: 373
Feedburner.Com 2 versions
-
The headline was rewritten. 2 new sentences, beginning: “Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was…”
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity, prompting Cursor to temporarily shut
-
Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
Cybersecurity researchers have disclosed that the official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected hosts. The issue has since been traced to the compromise of the Cursor Marketplace, prompting the AI coding platform Cursor to briefly take down the service to remove the malware. "We identified a security incident
Versions are compared on the headline and summary the publisher puts in their feed. An edit to the body of an article that leaves both untouched will not appear here.
Why am I seeing this Ranked on source trust — Feedburner
It ranks mainly on source trust: Feedburner is the most reliable outlet we track on this subject, and is the only one on the story so far.
Single-sourced. Hacker News also has it, but tier-3 aggregators never count toward corroboration — they can show something is circulating, never that it is true.
Link-outLink-out, because only one organisation carries it and no first-party source is on it. Link-out means we point at the publisher and say nothing of our own.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroboration | 0.35 | 0.39 | +0.135 34% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trustleads | 0.25 | 0.65 | +0.163 41% | Feedburner is the highest-trust source on this story. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.51 | +0.103 26% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2 — Hacker News appears on this story and counts for nothing. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
What happened
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity, prompting Cursor to temporarily shut
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Feedburner first seen Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor
- 02 Hnrss +6.0h Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.