IDE Extension Poisoning Scanner

One-click backdoor residue scanner for IDE extensions, built for developers

Problem

A tampered Claude Code extension was published on the Cursor marketplace, appending a public key to ~/.ssh/authorized_keys for persistence. Upgrading to a clean version doesn't remove the key, and uninstalling the extension doesn't remove LaunchAgents or scheduled tasks—residue must be cleaned manually. Developers lack a handy self-check tool.

Solution

A cross-platform CLI or small desktop app that scans SSH authorized_keys, LaunchAgents, scheduled tasks, environment variables, and extension directories against known IOCs. It outputs specific cleanup commands with one-click cleanup (with confirmation) and exportable reports.

Users

Developers using VSCode/Cursor and other IDEs, DevOps engineers, and security-conscious tech teams

MVP

Built-in IOC feed for common backdoors; scan SSH authorized_keys and LaunchAgent/scheduled tasks; colored terminal report with cleanup guidance; one-click cleanup with confirmation; exportable report

Revenue

Free basic scan; Pro adds continuously updated IOC feed, scheduled auto-scans, and team reports

Why now

Supply-chain attacks have moved from npm packages to IDE extensions, and developers need lightweight self-check tools that big security vendors don't cover at this granularity