Top
Best
New

Posted by _chall 1 day ago

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace(phorion.io)
https://cursor.com/blog/claude-code-extension-security-notic...
941 points | 538 commentspage 9
villgax 1 day ago|
What I dont understand is why the hell do these extensions & clis need to update every damn day. clearly there's no new models everyday, what the actual f.
meindnoch 1 day ago|
Because we need velocity. If we don't have velocity, we die.
hem777 1 day ago||
”I've confirmed Binance use Claude Code with this extension.”
fn-mote 1 day ago|
^^ Had to verify that this was a real quote from the chain and not a joke. It is accurate.
paaloeye 1 day ago||
Another reason for not using VS Code and derived and all their mess of extensions. I'm glad running Claude Code in Ghostty/Terminal is not affected.
jedisct1 1 day ago||
Keep sending all your secrets and giving full control of your devices to Anthropic.

This is fine.

xteam 1 day ago||
♟
syngrog66 14 hours ago||
Anthropic is a malware vendor (on many levels of abstraction): confirmed. But plenty of evidence visible to public eye, prior.

I forbid all-things-Anthropic on any machine I control, as of many months ago. In my private vendor "DNP" blacklist. Its designed as bait for the gullible or ignorant: the telltales are all right there. (Just like OpenClaw, for example.)

iJohnDoe 15 hours ago||
> I was working on the clearly mistaken impression that "Made by Anthropic" in the cursor store meant that the artifact had been signed by Anthropic. If that is not the case, then two party's need to get their act together:

Whoa! WTF? I always thought those were official releases by the companies. That's the only reason I trusted them. How is it possible they are being branded as official releases?

cookiengineer 1 day ago||
It's dangerous to go alone, take this [1]

[1] https://github.com/cookiengineer/check-claude-code-exfil

stopsayingsorry 1 day ago|
Imagine backdooring 50+ million installs.

Hats off to the hackers.

stbenjam 1 day ago|
5,000*
gcoakes 1 day ago|||
I think that's just the number Cursor has telemetry on. I think there's multiple distribution locations.
misnome 1 day ago|||
5000 is the cursor number for people on the cursor version of the store, not the VSCode store.
paxy 1 day ago||
The VSCode store wasn't hacked.
More comments...