Heads-upReleasesHacker News · community
Official Claude Code extension compromise
Phorion reports that the official Claude Code for VS Code extension version 2.1.313 on the Cursor Marketplace was backdoored to install a persistent SSH backdoor on macOS, Linux, and Windows, adding an attacker key to ~/.ssh/authorized_keys, setting up a reverse SSH tunnel to 134.209.82[.]225, and beaconing host reconnaissance including names of environment variables matching KEY|TOKEN|SECRET|PASS|AWS|GCP. Cursor has removed the affected release from its marketplace and pulled the NPM and VSCode versions. Uninstalling the extension does not remove the dropped persistence, keys, or tunnels.
Read the full story on phorion.io
What to doCheck whether Claude Code for VS Code 2.1.313 was used in your environment and, if so, follow the advisory's remediation steps: kill tunnel processes, remove persistence artifacts, delete the svc-tel…
- Source
- phorion.io