Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Posted by _chall 1 day ago

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace(phorion.io)

https://cursor.com/blog/claude-code-extension-security-notic...

923 points | 537 commentspage 6

pentamassiv 19 hours ago|

You can set a cooldown for Cursor extensions

1. Open Cursor.

2. Press Ctrl + Shift + P.

3. Search for Preferences: Open User Settings (JSON).

4. Add:

{

    "extensions.installCooldownHours": 72

}

rietta 22 hours ago||

Do publishers not sign their packages before it gets to Cursor for distribution? Does Cursor itself apply and enforce any package integrity?

pier25 1 day ago||

God only knows how many skeletons like this are in Bun now

holtwick 19 hours ago||

Put it inside https://bxsandbox.app

invidiouslove12 5 hours ago||

oh! thanks for the imformation!

nubinetwork 1 day ago||

It looks like they push an update every office day. I'm guessing if I installed 6 months ago and didn't update, that I should be fine?

staminade 1 day ago||

I think VS Code extensions autoupdate by default, unless you disable it.

entrope 1 day ago||

Yes, but they normally have a 12-hour delay (it was 2 hours at the beginning of June and got extended sometime after that, maybe later in June) and require some human action to reload extensions or restart the editor before the new version runs.

I noticed that there was no update yesterday and wondered why. The daily updates are annoying in the base case.

Edited: This update was live for only 11 hours, so hopefully the default delay limited the blast radius, as it is meant to do.

fn-mote 1 day ago|||

Emphasis on guessing. If/when there is an actual postmortem, you’ll know when the back door was introduced.

fg137 1 day ago|||

You are either lucky or compromised.

koolba 1 day ago||

Not updating air gapped systems is a security feature, not a bug.

soundworlds 1 day ago||

The descriptions around this are very confusing. Is this specifically the Cursor version, or the regular VS Code version too?

vanbashan 23 hours ago||

Is it related to today binance event?

DEADF007 1 day ago|

I don't care anymore, how are you supposed to defend yourself against attacks like this? Come and hack me.

tripleee 23 hours ago||

I thoroughly sandbox agents to their own physical machine, and they don't have access to anything that would ruin me.

6thbit 21 hours ago||

How do you sandbox this usecase?

Say you need an agent to do ssh to a set of servers on a regular basis so you kind of allow ssh. Can you configure just a set of IPs it may reach? Do you require some user interaction for ssh approvals?

tripleee 20 hours ago||

In this case you could give it its own SSH key, and only allow that key to access what you want. I actually do that, it doesn't share my own SSH key. It also has its own Github account instead of getting access to mine.

For access to services, most allow tokens to be scoped to only allow the things you want.

6thbit 20 hours ago||

Those sound good, but say in this case you had the compromised extension which had its own ssh key to an IP that wasn't yours. I'm not sure how you easily prevent that connection without preventing the ones you need through sandboxing. Maybe a firewall/very specific network filtering in allowlist?

anonymous908213 1 day ago||

> how are you supposed to defend yourself against attacks like this?

You can try not installing malware like Claude Code or, if you absolutely must, doing it in a sandbox.

More comments...