Poisoned Claude Code extension on Open VSX planted an SSH backdoor
Version 2.1.313 was on Cursor’s marketplace for about 11 hours; Cursor says at most 5,000 users were affected.
1
Stories per day · 30 days
Relatedcursor3prompt-injection2ai-coding-tools1claude-code1claude-desktop1codex1coding-agent1copilot1developer-tools1embedded-browser1extension1github-copilot1open-vsx1ssh-backdoor1supply-chain1vani1
4 stories, newest first · one card per story
Stories tagged #vs-code
Researchers find 'Embrace' embedded-browser flaws in five AI coding tools; Codex and VS Code unpatched
Flaws in Codex and VS Code remain unpatched; Cursor silently fixed code execution and GitHub fixed Copilot spoofing in 1.1.29.
1
Vani ships a preview coding agent extension for VS Code
The free Marketplace extension shows file edits as diffs and runs commands only after approval.
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.
3