Anthropic VS code extension on Cursor backdoored for nearly 12 hours
Summary
Ars Technica reports a supply-chain compromise where Anthropic's Claude VS Code extension via Cursor was backdoored for nearly 12 hours, potentially affecting up to 5,000 developers. The malicious version attempted to install a persistent SSH backdoor, add attacker SSH keys, enable SSH, and establish a reverse SSH tunnel to exfiltrate host and cloud credential data. The incident prompted removal of the malicious extension, key rotation, and a push of a clean update, with investigation into how the attackers gained control of the official distribution channel.