Developer Security: articles and guides

Microsoft's 30 Oct analysis of the tampered Claude Code extension in Cursor: the svc-telemetry SSH backdoor, IOCs, Defender detections, KQL and cleanup.

OVHcloud disclosed (19 October 2026) that its Command Line Interface repository was briefly compromised in a supply-chain attack: per CEO Octave Klaba, an attacker used a developer’s GitHub account to add a binary that steals secrets from disk. Malicious versions v0.11.0–v0.15.0 were blocked ~94 minutes after a customer flagged them; v0.10.0 and v0.16.0 are clean. A third-party, figures-attributed read of what happened and the release-pipeline and developer-account controls every security leader should check — with the facts attributed to The Stack and OVHcloud’s public statements.

On 17 Oct 2026 OpenCode told some users an intruder reached a legacy system and may have exposed stored OpenAI, Anthropic and Google keys. Rotate them now.

Elastic Security Labs is investigating @apexacc/cli, an npm package still live on the registry that disables Windows Smart App Control and AV exclusions, then chains Base64 PowerShell through Python/PyInstaller, PyArmor and a Go shellcode loader to an infostealer. What we know so far, credited to the source.