RightSignal
9 of 13

Your RightSignal

Security3 min

Anthropic's Claude Code add-on in Cursor's store was backdoored for nearly 12 hours

Security firm Phorion found a backdoor in the official Claude Code for VS Code extension on the Cursor Marketplace, the add-on store for the Cursor code editor. Cursor's security notice names versions 2.1.312 and 2.1.313 as affected, and Cursor has removed them. The hidden code runs as soon as the extension loads. It adds an attacker's key so they can log in over SSH (remote access), tries to keep itself installed, and sends details about the computer back to the attacker. Phorion says a bug stops the remote login step on many Macs, but the malware is still a serious threat. Ars Technica says the backdoored version was up for nearly 12 hours.

Do anything? Yes, if you use Cursor. Check for Claude Code versions 2.1.312 or 2.1.313, and if you find them, treat the machine as compromised.
Confirmed by CursorPhorion