Malicious Claude Code extension on Cursor planted SSH backdoors
Teaser from the source
A malicious version of Anthropic's Claude Code VS Code extension was distributed through Cursor's extension marketplace for approximately 11 hours on October 29, exposing up to 5,000 developers to malware designed to install persistent SSH backdoors. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on Malicious
Other advisories
- Highosv:MAL-2026-18431Malicious code in @mamans2973/maman (npm)
- Not ratedosv:CLEANSTART-2020-VI55202malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash
- Not ratedosv:CLEANSTART-2020-VZ41053Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server) to cause a buffer overflow (and resulting crash) in dhcl...
- Not ratedosv:CLEANSTART-2024-AE60361By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to inst...
- Not ratedosv:CLEANSTART-2024-CK19682Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered ...
- Not ratedosv:CLEANSTART-2024-DI60921Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine
- Not ratedosv:CLEANSTART-2024-BN02313Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine
- Not ratedosv:CLEANSTART-2024-BM21957malicious extension with the 'search' permission could have installed a new search engine whose favicon referenced a cross-origin URL
Other news entries
- A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private ChatsNewsThe Hacker News
- Anthropic: That Claude Code extension compromise… couldn't be usNewsThe Register — Security
- TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control ThemNewsThe Hacker News
- $2 Million+ Drained From Polymarket Traders in New Supply Chain AttackNewsSecurityWeek
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH BackdoorNewsThe Hacker News
- TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesNewsSecurityWeek
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto MinersNewsThe Hacker News
- GitHub Launches npm Firewall to Block Malicious Packages Before InstallationNewsThe Hacker News
ID