First screen, captured 3 days ago. Hover to scroll the page, or open the video.

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

What HN thinks

Three marketplaces, one fake version number, and everyone asking whose laptop it really was.

Cursor's marketplace was compromised
Anthropic staff repeatedly say the tampered 2.1.313 existed only on Cursor's proxy marketplace, not VS Code Marketplace or OpenVSX, and many commenters accept that and criticise Cursor's vetting.
Still Anthropic's problem and comms
Others argue the extension carried Anthropic branding, Anthropic's crisis communication was confusing, and signed extensions or trademark enforcement are needed; a few suspect Anthropic credentials or a cover-up.
Sandbox your AI tools
Many say agents and extensions have far too much access and should run in containers or VMs with limited secrets.

Consensus: Most agree the malicious build appeared only on Cursor's marketplace and that the extension ecosystem, especially OpenVSX with no signing, has weak supply-chain security.

Recommended in the comments

amazing-sandbox ↗ (tool): Limits the blast radius of a compromised agent or extension.
VSCodium (tool): Recommended alongside remote extensions to keep code and extensions off the host.
open-remote-ssh ↗ (tool): Lets extensions run inside a VM or container rather than the host machine.
QEMU (tool): Commenters run agents in isolated QEMU VMs with no production secrets and push code through git remotes.
Neovim (tool): Suggested as a simpler editor that avoids the VS Code extension marketplace.

Summarised by Claude from the comment thread 2 days ago.

Points: 950
Comments: 542
Best rank: #2
Posted: 2026-10-30 by _chall
Category: Security

supply-chain-attack claude-code cursor vs-code-extensions ssh-backdoor malware-analysis macos

All captures:

Full page

Captured 3 days ago. Click for the whole screenshot.

Looks similar

Screenshot of promptarmor.com: GitHub Copilot CLI downloads and executes malware

GitHub Copilot CLI downloads and executes malware (promptarmor.com)

43 points by sarelta 8 months ago | 12 comments

Screenshot of doublepulsar.com: Anthropic hacked to deliver remote access trojan

Anthropic hacked to deliver remote access trojan (doublepulsar.com)

361 points by bashtoni 3 days ago | 73 comments

Kevin Beaumont's DoublePulsar post reporting that a compromised Claude Code VS Code/Cursor extension version 2.1.313 installed an SSH reverse backdoor on developer machines.

supply-chain-attack claude-code anthropic vscode-extensions

Screenshot of doublepulsar.com: Anthropic hacked to deliver remote access trojan to Claude developer laptops

Anthropic hacked to deliver remote access trojan to Claude developer laptops (doublepulsar.com)

21 points by fk33 3 days ago | 3 comments

Kevin Beaumont's DoublePulsar post reporting that a compromised Claude Code extension version for VS Code and Cursor installed an SSH reverse backdoor on developer machines.

supply-chain-attack claude-code anthropic vscode-extensions

Screenshot of aws.amazon.com: Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure

Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure (aws.amazon.com)

227 points by cubefox 11 days ago | 98 comments

AWS Security Blog post reporting that Amazon's MadPot honeypots saw PHP2Shell exploitation attempts four days before public disclosure, with IOCs and recommended actions.

php php2shell zero-day vulnerability-disclosure

Screenshot of safedep.io: Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor (safedep.io)

582 points by abhisek 12 days ago | 192 comments

SafeDep analysis of the compromised LiteLLM 1.107.0 PyPI release, which installed a credential stealer and remote-code backdoor via .pth and sitecustomize files, with IOCs.

supply-chain-attack litellm pypi python

Screenshot of github.com: Show HN: Bring-your-own-key browser extension for summarizing HN posts with LLMs

Show HN: Bring-your-own-key browser extension for summarizing HN posts with LLMs (github.com)

57 points by ivanyu 1 year ago | 24 comments

Full page

Looks similar

GitHub Copilot CLI downloads and executes malware (promptarmor.com)

Anthropic hacked to deliver remote access trojan (doublepulsar.com)

Anthropic hacked to deliver remote access trojan to Claude developer laptops (doublepulsar.com)

Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure (aws.amazon.com)

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor (safedep.io)

Show HN: Bring-your-own-key browser extension for summarizing HN posts with LLMs (github.com)

Related stories

Backdoors in official Claude Code extensions (cyberplace.social)

Anthropic hacked to deliver remote access trojan (doublepulsar.com)

Anthropic hacked to deliver remote access trojan to Claude developer laptops (doublepulsar.com)

Claude Code can debug low-level cryptography (words.filippo.io)

The cult of vibe coding is dogfooding run amok (bramcohen.com)

Unauthenticated remote code execution in OpenCode (cy.md)