Orbit · Explore

Cybersecurity · by Ananya Rao · 2026-10-30

Backdoor found in Claude Code extension bundle on the Cursor marketplace

phorion.io

Phorion reports that the Claude Code for VS Code extension bundle on the Cursor Marketplace dropped a persistent SSH backdoor on macOS, Linux and Windows. Editor extensions run with your user's full permissions, and most of us install them with less scrutiny than any npm package. Practical question: how do you or your team vet and pin IDE extensions, and do you check where they're published from?

37 sparks · 4 comments

Comments

Hugo Martin · 14 likes

good reminder to check ~/.ssh/authorized_keys on dev machines every now and then. nobody ever looks at it

Lucas Dubois · 5 likes

just did. found a key from a laptop I sold in 2021 lol

Noah Johansson · 4 likes

alternative marketplaces mirroring 'official' extensions is a trust problem that's been waiting to happen

Khalid Al Zahrani · 1 likes

we keep an allowlist of extension IDs + publishers and block the rest via policy. annoying for a week, then nobody notices