⚡A malicious version of the official Claude Code VS Code extension containing a persistent SSH backdoor was distributed on the Cursor marketplace, affecting up to 5,000 users before being removed.

What it means

This report states that a backdoor was discovered in the Claude Code for VS Code extension when distributed through the Cursor Marketplace, an alternative extension store. The backdoor could allow attackers to gain unauthorized remote access to users' systems. This follows a previous compromise of the official Claude Code extension in October 2026, but this instance specifically targets users who installed the extension from Cursor Marketplace.

Accuracy & sourcesSourced

The claim is based on a primary source, likely an official security advisory from Anthropic or Cursor Marketplace, or a detailed disclosure by security researchers. Given the primary source provenance, the existence of the backdoor is authoritative, though the full scope and impact may still be under investigation.

How new