Backdoors in official Claude Code extensions

Re:Backdoors in official Claude Code extensions by ddworken on Friday October 30, 2026 @11:09AM (#50305012)

Dworken from Anthropic here: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.

[ Parent | on HN ]

Re:Backdoors in official Claude Code extensions by xx_ns on Friday October 30, 2026 @12:35PM (#50306364)

Thanks for clarifying!

[ Parent | on HN ]

Re:Backdoors in official Claude Code extensions by arm32 on Friday October 30, 2026 @04:47PM (#50309931)

Hi Dworken from Anthropic, how is that possible if Cursor uses OpenVSX?

[ Parent | on HN ]

Re:Backdoors in official Claude Code extensions by zbentley on Friday October 30, 2026 @09:04PM (#50312209)

It seems like they put a proxy in front of OpenVSX: https://cursor.com/help/customization/extensions

However, statements around the internet (and in these comments) are less than definitive as to whether a) that proxy has a cache that was compromised; b) that proxy has select extensions which can be published directly to it by hand (one of which was compromised); c) other.

[ Parent | on HN ]

Re:Backdoors in official Claude Code extensions by olejorgenb on Saturday October 31, 2026 @12:11PM (#50317441)

It's really not acceptable that Cursor is less than crystal clear on details such as this...

[ Parent | on HN ]

Re:Backdoors in official Claude Code extensions by matt3210 on Friday October 30, 2026 @08:02PM (#50311774)

Thanks! I would believe it more it if you shared your system prompt so I can make sure its really you.

[ Parent | on HN ]