Claude Code VSCode extension reportedly backdoored via OpenVSX, not related to Cursor
jedisct1 · x · 2026-10-30
jedisct1 clarifies that the reportedly compromised official Claude Code VSCode extension has nothing to do with Cursor: the extension was published on OpenVSX — the registry all VSCode forks rely on — and owned by Anthropic employee Igor Kofman. The incident highlights a supply-chain attack surface beyond the VSCode Marketplace, with SSH backdoor planting and potential poisoning of fork/mirror channels.
More from coding & agent
- OpenAI DevDay community edition lands in Stockholm Nov 21 with $150 in credits — paw_lean · 2026-10-30
- Microsoft's Work IQ connects business app context, unveiled at PPCC26 keynote — donasarkar · 2026-10-30
- Codex turns Apple Photos pets into a Samsung Frame TV art channel — sch · 2026-10-30
- YC-Backed Mirrors Launches to Catch and Fix Your AI Agent's Repeated Mistakes in Real Time — ycombinator · 2026-10-30
- Perplexity Computer can now control your Chrome via new extension — AravSrinivas · 2026-10-30
- Vicem: Open-Source Tool Hands Off Task State Between Coding Agents — NoConclusion8361 · 2026-10-30