Hacker News new | past | comments | ask | show | jobs | submit
tekawade | on: Backdoor in Claude Code for VS Code extension on the Cursor Marketplace
Anthropic only has an official extension for VS Code. Cursor is vs code fork and gave its own marketplace.

IIUC Anthropic does not publish extensions for Cursor. It’s basically, official Claude code extension “clone” not by Anthropic.

Ai summary in better words: The Recent Malicious Build (v2.1.313): A tampered version of this extension (version 2.1.313) was uploaded to the Cursor extension marketplace. This specific, malicious build was not developed or authorized by Anthropic. Attackers effectively hijacked or spoofed the extension's legitimate identity within the Cursor/Open-VSX system to bundle an unauthorized SSH backdoor into the real Anthropic code.

no-name-here | parent | next
> Anthropic only has an official extension for VS Code.

That likely seems incorrect as I see Claude Code listed on open-vsx with:

* An "Anthropic" "Verified publisher" badge

* igorkofman listed who seems to be an Anthropic employee

* 63M downloads

* Reviews going back >1 year

https://open-vsx.org/extension/Anthropic/claude-code

loading story #50306816
loading story #50305467
mday404 | parent
The AI summary here is right and the human info is wrong -- Anthropic does publish the Cursor extension in general, but did not publish this version
loading story #50312599