Phorion

Headlines · 1

1. 1d
   Tampered Claude Code Extension in Cursor Marketplace Attempted SSH Backdoor

   Cursor said a tampered Claude Code for VS Code extension reached at most 5,000 users through its marketplace and was not developed by Anthropic. Phorion found that version 2.1.313 contained code that collected host and user information, sought the names of environment variables associated with keys, tokens and secrets, added an attacker-controlled SSH key, and attempted to establish a reverse tunnel with cross-platform persistence. Reports noted that errors may have prevented remote access from working on many systems; one report also listed version 2.1.312 as affected. Cursor removed the malicious releases, temporarily disabled the marketplace, worked with providers to neutralize the malware, restored the marketplace and asked users to update to version 2.1.314.

   Cursor (X) · 🔥 71

Experience and discussion from the community

Share my Phorion experienceAsk about Phorion