Official Claude Code Extension Compromise: Security Advisory
- TL;DRPhorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows.
- This write-up focuses primarily on macOS, where the extension attempts to configure an SSH backdoor and establish persistence.
- Organisations should immediately review their environments for use of Claude Code for VSCode 2.1.313 and engage incident response where use of the extension is discovered.
Unverified
- TL;DRPhorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows.
- This write-up focuses primarily on macOS, where the extension attempts to configure an SSH backdoor and establish persistence.
- Organisations should immediately review their environments for use of Claude Code for VSCode 2.1.313 and engage incident response where use of the extension is discovered.
Sources: Phorion