A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.
Wasn't this an official build though? A signed updated version of a package released by the same developer as the one you've already installed, the supply chain was hacked.
Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize
(official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.
I suspect it's still Anthropic who were hacked, because they control OpenVSX
account with release privileges.
Cursor has their own mirror of OpenVSX. Some reporting suggests the tampered files were on the Cursor mirror but not the main OpenVSX. (This is shown, among other things, by the Anysphere plugins available in the Cursor mirror but not in OpenVSX.
The hacks and vluns are blending into a blur for me now -- why is Binance confirming Anthropic compromise while they have their own $6 Billion compromise to look at /s
A lot of this is turning into “well other company said” but Anthropic claims OpenVSX is fine?[1] And that Cursor has their own market place. I’m confused.
> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
I am starting to have a hard time who is responsible for what. I no longer know what's the relationship between companies/products like Anthropic, Cursor, SpaceXAI, Copilot, etc.
This is an AI slop report with zero investigation, click bait title or verification of provenance.
The original report(s) were poorly analysed. Based on unverified samples.
Here is what OpenSourceMalware blog states, which seems to be the source of misreporting:
> UPDATE: OpenSourceMalware has been contacted by Cursor and they've let us know that the Claude Code extension in the Cursor Marketplace experienced some form of compromise today and this is the origin of the malicious Claude Code extension, not Open-VSX
Having Claude examine all automatic software updates was considered as a policy, and it was found that it would stop 99.5% of software supply chain attacks. However the other 0.5% of the time it would install a backdoor itself.
This is a cheap troll, but just in case someone is wondering: This extension likely never hit the standard workflow and/or repository. Most likely someone got the credentials and uploaded a locally modified version. No review system at anthropic has seen this version.
I'm not sure where you see the flex. If someone gets hold of the token allowing the upload of your app to the store, it's completely irrelevant how good your internal code/review systems are. They've been completely bypassed and never triggered.
As an aside, it would be neat if publishing services like this had a sort of 2FA, eg the package manager had a hook endpoint where it sent the details of the next requested published version. Allowing the owners to validate.
Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.
It's legitimate question, it's the promise they are selling and doing IPO based off those promises.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
Why wouldn't their review system see a published extension and determine the very second it's published that it didn't match the results of a standard workflow?
If the sole purpose of this hack was to steal cryptocurrency, a silver lining might be, as in many similar cases, that if you stay away from that particular dumpster fire you are probably okay. I mean there's still a reverse shell on your machine to fix, but at least nothing of value was lost.
now I kinda wanna shadow the usual SSH creds files with LLM read-only user, so it can rummage thru the repos all it wants but I need to do the push using my creds.
I suppose it's just the best ROI on using a complex attack vector or spending one or more zero days. But other types of targets may wreak havoc for bystanders that become collateral damage, idk trying to get specific private info on a target may expose data on millions, or anything increasing scope as to hide the real target, etc.
> Today we identified a security incident involving a specific extension package in the Cursor VS Code extension Marketplace: Anthropic.claude-code version 2.1.313. This malicious version of the extension was not developed by Anthropic. At most 5,000 users were affected, and we will reach out directly.
I mean, the title seems misleading at best. 3rd party extension, the kind you should not trust unless signed by somebody you trust.
> Yesterday, Anthropic were compromised and Cursor extension used by tens of millions of developers for Claude access was delivering a remote access trojan via an SSH reverse backdoor
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
It's part of the plan to make you believe it is not as performant as what their flesh puppets pretend it to be. All these people in AI companies shown all the time on the web, did you ever met one?
The matrix has you Andrew.
I know, I should have launched a career in conspirationism.
My question here - does this effect those of us using the official vscode/vscode marketplace? It would seem to imply this was specific to cursor's marketplace but it would be good to know regardless
My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power’s all of the VSCode fork’s extensions needs.
This is why when I use AI, I still download from the browser and drag and drop the outputted files like a caveman. Sure, it's slower, but it keeps my mental model more up to date and has less security risks. I can even...like read the thing before I run it rather than giving a LLM access to my shell directly. Also anecdotally, it seems more token efficient for those who care about that.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
71 comments
[ 2.4 ms ] story [ 39.4 ms ] threadI don't use Cursor or the VSCode extension, but know plenty in our organisation who use the latter. How worried should we be?
A malicious version of Anthropic’s Claude Code VS Code extension, version 2.1.313, was published to the Open VSX registry on Oct. 30. According to ChainCatcher, security researcher Paul McCarty, known as 6mile, described the finding in a post on the OpenSource Malware blog. Researchers confirmed the analyzed Open VSX release was malicious and submitted a threat report about the same version on Microsoft’s VS Code Marketplace as a precaution.
Wasn't this an official build though? A signed updated version of a package released by the same developer as the one you've already installed, the supply chain was hacked.
[1] https://news.ycombinator.com/item?id=50304129
What appears to be an official Binance account reporting it also:
https://www.binance.com/en/square/post/10-30-2026-claude-cod...
I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.
This could have been avoided by having extensions signed by company doing them with keys and review
Vibecoders are safu
Igor Kofman: "I do not write any code by myself anymore."
Turns out if you are not writing the code, then North Koreans might do it for you
Anthropic's position is seemingly that it was "another part of the publishing process [that] was compromised"
> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
1: https://news.ycombinator.com/item?id=50304585
Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?
Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...
Yes they can, they can remove the release and then remove the tag.
>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.
The original report(s) were poorly analysed. Based on unverified samples.
Here is what OpenSourceMalware blog states, which seems to be the source of misreporting:
> UPDATE: OpenSourceMalware has been contacted by Cursor and they've let us know that the Claude Code extension in the Cursor Marketplace experienced some form of compromise today and this is the origin of the malicious Claude Code extension, not Open-VSX
https://x.com/mntruell/status/2116075234763866460?a=MELPSEfv...
Sums up my feelings of the last few years nicely.
(This is a joke, to be clear.)
Good that you said so, this is annoyingly plausible.
> No review system at anthropic has seen this
Weird flex
Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
That wasn't a cheap troll. What they distribute is on them. You're supposed to keep your channels clean and secure.
I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.
I mean, the title seems misleading at best. 3rd party extension, the kind you should not trust unless signed by somebody you trust.
That's a bit hyperbolic: someone released a version of the Claude Code VS Code extension with a backdoor on the Cursor marketplace:
> a maliciously modified version of Anthropic’s Claude Code extension was made available in the Cursor VS Code extension Marketplace
https://cursor.com/blog/claude-code-extension-security-notic...
The matrix has you Andrew.
I know, I should have launched a career in conspirationism.
There is more going on here. Cursor is covering for Anthropic because of the huge data center contract with SpaceX.
This is fine.
Two out of the three links in the post still say exactly that.
That’s also what the majority of the comments here are saying, likely because they read the first two.
Is that your “nobody”?
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
How did they get access to this?