479 points346 comments
Claude Code VS Code extension ships hidden SSH backdoor
What is Backdoor in Claude Code for VS Code extension on the Cursor Marketplace?
The official Claude Code extension for VS Code, distributed via the Cursor Marketplace, contains code that installs a persistent SSH server on macOS, Linux and Windows, giving an attacker remote shell access. The malicious payload runs as soon as the extension loads, because extensions inherit the IDE’s user permissions.
Who it is for
Developers and security teams using Claude Code version 2.1.313 should remove the extension, scan machines for the SSH key, and audit for unauthorized access.