Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Posted by _chall 1 day ago

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace(phorion.io)

https://cursor.com/blog/claude-code-extension-security-notic...

901 points | 532 commentspage 3

nunez 19 hours ago|

Kind of surprised that Cursor doesn't do checksum verification for plugins. That would have stopped this completely. (Unless it does and this backdoor is more theoretical than anything else.)

ale42 1 day ago||

Is this affecting only people using Cursor or all VS Code users? The article specifically mentions the Cursor marketplace. But the affected version is indeed missing on the official VS Code marketplace, was it compromised too?

feross 14 hours ago|

[flagged]

_hmj 22 hours ago||

Development must occur in an isolated VM, with no access to the publishing workflow. CI operations must happen in a separate VM or on the host system after scanning all files. Thus, even if the development tools are compromised (like this case), the impact is limited.

Still, it’s hardly a surprise that best practices are rarely followed with any consistency.

cryptonym 19 hours ago||

Maybe because the tools aren't of much help. This is all theory but when you want to do it it's custom solutions and duct tape.

There is too much friction when you try to isolate things. You have to do custom stuff then the company won't let you virtualize (can't install stuff...) or won't allow you to enroll the vm and will threaten you if you dev on an OS that is not enrolled.

Best you can get from state-of-the-art-frontier-top-it-company is an IDE with an exec sandbox leaking like an hourglass.

plaguuuuuu 11 hours ago||

compromised extension then backdoors your code anyway

throwitaway222 15 hours ago||

This kind of thing is only going to get worse. People assume other devs are "like them" but state actors (think US, NK, RS, CN) are likely using AI at this point to run agents non-stop to break security by making dev tools or contributing to open source. Keep in mind that open source is the backbone of nearly all software being used - we're in for a rough ride if we don't treat all new things coming in as if they are potentially a nuclear bomb masquerading as a trojan horse.

notaproton 15 hours ago|

> we're in for a rough ride if we don't treat all new things coming in as if they are potentially a nuclear bomb masquerading as a trojan horse

It's lucky that management doesn't want a 10x increase in output after laying off half the staff so we have a lot of time to vet deps! Oh no...

stbenjam 23 hours ago||

We still don’t know exactly what happened, but I publish software to public registries, and supply chain attacks scare the hell out of me. They also frustrate me, because most of the defenses aren't automatic and often really hard to get right. We're really failing as an industry to do better here.

poelzi 23 hours ago|

This is why I started to move more and more into my tix.im environment. You can't trust anything anymore - I assume everything is compromised if not proven otherwise.

efficax 23 hours ago||

either the registry is compromised or someone at anthropic got compromised (or did it on purpose to steal crypto). the line in the cursor disclosure about the extension not being developed by anthropic is more confusing than clarifying. amateur hour for these massive corps

hughw 20 hours ago||

Idea: why don't all the various app stores and plugin repos use LLMs to review all submissions for security? Certainly in the human powered age that was too big a task to take on, but now it seems doable.

jacquesm 21 hours ago||

Anthropic is a weird company. On the one hand they have this messianic thing about their super intelligence, on the other hand it is incapable of keeping their own house secure. But you should trust it.

rietta 22 hours ago||

Reading the report alone: "First, the payload makes sure ~/.ssh exists and appends an attacker-controlled Ed25519 public key to ~/.ssh/authorized_keys, setting permissions to 0700 on the directory and 0600 on the file."

A system where ~/.ssh/authorized_keys has not been modified might be a hint that this did not execute - the article does not mention self cleanup/reverting to previous status behavior by the malware. By default /var/log/auth.log is only of marginal value because outbound SSH connections are not logged by default.

xena 10 hours ago|

I would have loved to know that this was for CURSOR and not VISUAL STUDIO CODE before I spent 2 hours resetting all my API keys and getting ready to fully reimage a machine.

More comments...