Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
- ID
- 41137
- Status
- summarized
- Published
- 30 Oct 2026, 4:55 PM
- Fetched
- 30 Oct 2026, 9:31 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 7.5
- Created
- 30 Oct 2026, 9:32 PM
- Tags
- Audience
- developersvibe_codersai_agent_users
What happened
The Hacker News headline reports that the official Claude Code VS Code extension was compromised to install a persistent SSH backdoor; the supplied headline references the Cursor Marketplace instead. The excerpt provided contains only the headline, byline, publication timestamp (Fri, 30 Oct 2026 10:44:25 GMT) and page chrome — no affected version numbers, distribution window, indicators of compromise, attacker attribution, or vendor response. Treat the specific mechanics as unverified until the full article is read.
Why it matters
If you or your team installed the Claude Code extension through the VS Code or Cursor marketplace, this is a supply-chain compromise of a coding tool that typically runs with your full developer credentials — meaning SSH keys, cloud tokens and repo access on that machine should be treated as potentially exposed. Concretely: check whether you have that extension installed, and if so rotate SSH keys and any long-lived cloud or Git tokens on affected machines before doing anything else. The excerpt does not give the compromised version range, so you cannot yet determine whether a specific install was affected — that detail has to come from the full article or the vendor's advisory.
Discussion angle
Coding assistants run with full developer credentials by design — so what is your team's rule for marketplace extensions: pin versions, disable auto-update, or restrict installs to a vetted allowlist? Worth settling before the next incident, not during it.