Cursor marketplace hack backdoored Claude Code for 11 hours; Cassandra tool checks your machine
dunkhippo33 · x · 2026-11-02
On Oct 29, Cursor's marketplace was hacked and Anthropic's Claude Code extension (2.1.312/2.1.313) was replaced with an AI backdoor. For eleven hours, auto-update installed it on Mac, Linux and Windows machines. Cursor's fix swapped the extension back, but the attacker's SSH key (svc-telemetry), a fake Apple LaunchAgent and a reverse-tunnel service remained on every affected machine.
The post promotes Cassandra by Ciphero: a single read-only command that in seconds checks whether these traces exist on your machine and scans all editor/browser extensions against 11,174 known-malicious ones — no sudo, nothing installed, nothing leaves your machine without consent. One-time commands for macOS/Linux (bash) and Windows (PowerShell); lists refresh every 6 hours.
Related event: Cursor Marketplace Hacked with AI Backdoor in Claude Code Extensions(2 posts)→
More from coding & agent
- Model swap cut costs 59% and latency 75% — and he still blocked the release — Fun_Employment6042 · 2026-11-03
- Context drift broke a production LLM deployment by turn 10 — no jailbreak needed — GasProfessional5544 · 2026-11-03
- Obsidian dev open-sources Pele, a Mermaid-compatible renderer 100-500x faster than mermaid.js — Teknium · 2026-11-03
- Agent-built eval harness spawns subagents via codemode in one durable session — mitsuhiko · 2026-11-03
- SurfSense runs Claude Code and opencode as dual engines — lessons from a local NotebookLM — FurtiveMirth · 2026-11-03
- Impeccable crosses 100k GitHub stars, with weeks of releases teased ahead — jamdac · 2026-11-03