Weekly ranking, Technology

Official Claude Code Extension Compromise: Security Advisory | Phorion

phorion.io, Technology

A hands-on teardown of the backdoored Cursor Marketplace Claude Code extension, giving specific IOCs, the bugs that blunt the payload on each platform, and practical detection advice.

What it adds

Detailed reverse-engineering of the payload, including the macOS, Windows and Linux implementation bugs, plus concrete IOCs and detection guidance.

Claim by claim

• 11 the author's own
• 0 an AI would say
• 2 known elsewhere
• 0 common knowledge

Its strongest original claims

• The official Claude Code for VS Code extension on the Cursor Marketplace was backdoored with a persistent SSH backdoor affecting macOS, Linux and Windows.
• Cursor identified versions 2.1.312 and 2.1.313 as affected and removed them from its marketplace.
• The payload is an IIFE prepended to extension.js that runs on module load, before activate, without user interaction.
• On macOS, systemsetup -getremotelogin run without root prints an admin error and exits 0, so the Off check fails and SSH enablement is skipped.
• The Windows path has a bug: the PowerShell setup is passed through a helper that hardcodes /bin/sh.

Scored by Expulp Verdict for what the piece adds beyond what is already known and published. The full verdict shows every claim with its reasons. Leaderboard, what Verdict gets right and where it is weak.