Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Security researchers at Phorion recently uncovered a serious security issue involving the Claude Code extension available on the Cursor Marketplace. Bad actors managed to bundle malicious code into specific extension versions (2.1.312 and 2.1.313), attempting to grant unauthorized remote access to a user's computer via SSH the moment the tool loaded.

The affected versions have since been pulled from the marketplace. Because code editor extensions run with the same permissions as your regular user account, a compromised plugin can access your local files and system settings without needing extra approvals.

If you use Cursor and installed the Claude Code extension recently, take a quick moment to ensure your extensions are updated or check your system setup. As you explore new AI tools, it is a healthy habit to stick to verified marketplace listings, keep your extensions updated, and stay mindful of what you install in your development environment.

Community discussion: https://news.ycombinator.com/item?id=50300683