Phorion found a persistent SSH backdoor in the official Claude Code for VS Code extension, version 2.1.313, on the Cursor Marketplace. It has setup logic for macOS, Linux and Windows. Cursor pulled the release, and the 2.1.313 builds were also pulled from npm and the VS Code registry. If you use the extension, worth checking which version you have.

Do you let editor extensions auto-update, or do you pin versions?

tech

Phorion found a persistent SSH backdoor in the official Claude Code for VS Code extension, version 2.1.313, on the Cursor Marketplace. It has setup logic for macOS, Linux and Windows. Cursor pulled the release, and the 2.1.313 builds were also pulled from npm and the VS Code registry. If you use the extension, worth checking which version you have.

Do you let editor extensions auto-update, or do you pin versions?