NewsThe Hacker News
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
More on Marketplace
Other advisories
- Criticalpwn_watch:claude-code-vscode-extension-ssh-backdoor-oct-2026Trojanized Claude Code VS Code extension (Anthropic.claude-code 2.1.312 and 2.1.313) in Cursor's extension marketplace planted an SSH backdoor on up to 5,000 machines
- MediumCVE-2026-72528CREEMA "Handmade Marketplace App - Creema" for Android: Open Redirect
- MediumCVE-2026-72528Die Handmade Marketplace App - Creema von CREEMA LTD.
- HighCVE-2026-57806Drfuri Martfury - WooCommerce Marketplace WordPress Theme: Cross-Site-Scripting (XSS)
- HighCVE-2026-57806Drfuri Martfury - WooCommerce Marketplace WordPress Theme: Cross-Site-Scripting (XSS)
- HighCVE-2026-39794WC Lovers WooCommerce Multivendor Marketplace: fehlende Autorisierung
- HighCVE-2026-39794WC Lovers WooCommerce Multivendor Marketplace: fehlende Autorisierung
- HighCVE-2026-82406Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace in github.com/klever-io/klever-go
Other news entries
- Malicious Claude Code extension on Cursor planted SSH backdoorsNewsBleepingComputer
- 10 most powerful cybersecurity companies todayNewsCSO Online
- As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messagesNewsCSO Online
- Yam Store: The Phishing Network Behind a Billion MessagesNewsDark Reading
- Owner of Empire cybercrime market gets 40 years in prisonNewsBleepingComputer
- Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectorsNewsBleepingComputer
- Kosovar Owner of Rydox Marketplace Pleads Guilty in US CourtNewsSecurityWeek
- Rydox marketplace admin pleads guilty, faces 22 years in prisonNewsBleepingComputer
Source: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html
ID