VS Code Extension Backdoored for Supply Chain Attack
A supply chain attack compromised an official Anthropic Claude VS Code extension on the Cursor Marketplace, potentially affecting thousands of developer machines. The backdoor was active for nearly 12 hours before being mitigated.
Confirmed by several outlets
- An official Anthropic Claude VS Code extension was compromised. — WIRED and Ars Technica AI
- The compromised extension was on the Cursor Marketplace. — Hacker News and Ars Technica AI
Reported by one outlet so far
- The compromised package was a VS Code extension. — Ars Technica AI
- The incident was reported on Friday. — Ars Technica AI
- The backdoor was active for nearly 12 hours. — Ars Technica AI
- Flawed code in the Claude extension prevented full exploitation. — WIRED
ImpactTop story 75/100
Coverage3 outlets in 1 country within 14 hours
First reportedHacker News, Fri, 30 Oct 2026 07:09:12 GMT
Who reported it
How this page was made
This page was written automatically. An AI model wrote the headline, summary and lists from the headlines and short extracts of the outlets above. A second AI model then checked every statement against each outlet it is credited to; what it could not confirm was removed, and a page with a statement no outlet supports is not published. For the full story, read the outlets' own reports. See our editorial policy or report a mistake.