Official Claude Code extension compromise
Comments on “Official Claude Code extension compromise”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A trojanized Claude Code extension, versions 2.1.312 and 2.1.313, was served on the Cursor Marketplace for roughly eleven hours on one day, according to Cursor. Phorion's analysis shows a prepended loader that plants an SSH key, opens a reverse tunnel, adds persistence and beacons host details. Cursor says errors in the code would make the SSH step fail outside unusual privilege cases, and the attacker server has been taken down. The npm and OpenVSX packages were reportedly unaffected. Teams should check installed extension versions and remove the persistence files.
Why it ranked
No. 3 of 111 with a score of 0.77. The panel rated it highest on technical depth (0.93) and reader interest (0.90), lowest on audience breadth (0.65). Placed No. 3, No. 4 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Detailed technical incident analysis of a backdoored official IDE extension with IOCs and remediation; highly relevant to builders and security teams, strongly substantiated, and new relative to recent coverage.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, actionable supply-chain compromise analysis with malware behavior, persistence mechanisms, indicators, detection guidance, and remediation. It is highly relevant to developer environments, though the vendor detection pitch adds some promotional content.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.77total under rubric v2.3
- Significance0.73
- Reader interest0.90
- Audience breadth0.65
- Practical relevance0.88
- Substantiated0.84
- Technical depth0.93
- New information0.89
- Counts against: Promotional0.16
- Counts against: Overclaim0.21
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.67 | 0.80 | 0.72 | 0.73 | 0.13 | +0.24 | +0.175 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.84 | 0.95 | 0.91 | 0.90 | 0.11 | +0.26 | +0.234 |
| Audience breadthHow many people who build technology does it concern? | 0.52 | 0.80 | 0.62 | 0.65 | 0.28 | +0.13 | +0.084 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.89 | 0.90 | 0.86 | 0.88 | 0.04 | +0.22 | +0.194 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.84 | 0.85 | 0.84 | 0.84 | 0.01 | +0.05 | +0.042 |
| Technical depthHow technically substantive is it? | 1.00 | 0.90 | 0.88 | 0.93 | 0.12 | +0.05 | +0.046 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.83 | 0.90 | 0.93 | 0.89 | 0.10 | +0.05 | +0.044 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.09 | 0.10 | 0.28 | 0.16 | 0.19 | −0.19 | −0.030 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.36 | 0.10 | 0.18 | 0.21 | 0.26 | −0.11 | −0.023 |
| Sum of contributions | +0.767 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.767 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-31/3/"><img src="https://rubric.hrih.si/badge/2026-10-31/3.svg" alt="Ranked #3 on Rubric, 31 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
Phorion detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows.
The article gives no link or citation for it.
The article says “Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that drops a persistent SSH backdoor across macOS, Linux, and Windows”
The source says No source to compare with.
No source givenVersion
Version 2.1.313 of Claude Code for VSCode is the affected version.
The article gives no link or citation for it.
The article says “review their environments for use of Claude Code for VSCode 2.1.313”
The source says No source to compare with.
No source givenCausal conclusion
Cursor removed the associated release from its marketplace and pulled NPM and VSCode versions 2.1.313 from their registries.
The article gives no link or citation for it.
The article says “Cursor has removed the associated release from its marketplace, additionally pulling NPM and VSCode versions for 2.1.313 from their relevant registries”
The source says No source to compare with.
No source givenCausal conclusion
On macOS, running systemsetup -getremotelogin as a standard user prints an administrator-access error and exits with status 0 instead of returning Off, so the malware skips enabling SSH.
The article gives no link or citation for it.
The article says “When run as a standard user, systemsetup -getremotelogin prints an administrator-access error and exits with status 0 instead of returning Off”
The source says No source to compare with.
No source givenNumber
The malware appends an attacker-controlled Ed25519 public key with comment svc-telemetry to ~/.ssh/authorized_keys.
The article gives no link or citation for it.
The article says “appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys”
The source says No source to compare with.
No source givenNumber
The malware sets up an outbound reverse SSH tunnel to 134.209.82[.]225 on port 22 as user tunnel.
The article gives no link or citation for it.
The article says “the script sets up an outbound SSH connection to 134.209.82[.]225 as the tunnel user on port 22”
The source says No source to compare with.
No source givenNumber
The macOS persistence is a LaunchAgent named com.apple.sysmond.plist running /bin/sh ~/.config/.smt with RunAtLoad and KeepAlive true.
The article gives no link or citation for it.
The article says “Writes a user LaunchAgent that runs /bin/sh ~/.config/.smt with RunAtLoad and KeepAlive set to true, then loads it via launchctl”
The source says No source to compare with.
No source givenNumber
The beacon sends only names (up to 40) of environment variables matching KEY|TOKEN|SECRET|PASS|AWS|GCP, not their values, so secret values are not exfiltrated.
The article gives no link or citation for it.
The article says “Because it only grabs the variable names, the beacon doesn’t exfiltrate the secret values themselves”
The source says No source to compare with.
Also covered by
- Trojanized Claude Code Extension Plants an SSH Backdoor
- Malicious Claude Code Extension Found in Cursor Marketplace
- Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwide
- Anthropic hacked to deliver remote access trojan to Claude developer laptops
- The backdoored Claude Code 2.1.313 build in Cursor's marketplace, explained
- Anthropic: That Claude Code extension compromise… couldn't be us
Elsewhere
Elsewhere: HN 856 pts, front page
Recorded for context only, checked 31 Oct 2026, 05:46 UTC. It played no part in the ranking.