SSH backdoor reported in Claude Code VS Code extension on Cursor marketplace
- Status
- Unverified: only social posts report this so far
- Kind
- Malicious package
- Vendor
- Claude Code
- Product
- Claude Code VS Code extension (Cursor marketplace)
- First seen
Summary
A post reports that a critical SSH backdoor was discovered in a Claude Code VS Code extension distributed through the Cursor marketplace, describing it as a supply chain attack that exposed developer machines. The post is truncated, so the extension's publisher, version range, and scope of exposure are not confirmed in this item.
If you use Claude Code
Uninstall the Claude Code extension from Cursor and VS Code and check that the publisher is the official one
Review ~/.ssh/authorized_keys and recent SSH logins for unknown keys or sessions
Rotate SSH keys and credentials that were present on affected developer machines
Follow the full advisory from the researchers or the marketplace for indicators of compromise
What the sources say 1
· Bluesky: “Critical Security Alert: SSH Backdoor Discovered in Claude Code VS Code Extension on Cursor Marketplace” Source