For about 11 hours on October 29, a trafficked copy of the Claude Code extension (versions 2.1.312 and 2.1.313) was served to Cursor users. Anthropic ensures that its own channels have not been affected.
An attack on the supply chain targeted developers using Cursor. On 29 October, for nearly 11 hours, the publisher's extension market place distributed a modified version of the Claude Code extension, numbered 2.1.312 and 2.1.313. Cursor estimates that no more than 5,000 people installed it, removed the package, put its shop offline as a precaution, and said they found no other altered extension. Anthropic, by Felix Rieseberg's voice, states that neither his systems nor his employees' computers have been compromised: the copy never passed through Microsoft's Visual Studio Marketplace nor through npm.
What the injected code was doing
According to the analysis of the company Phorion, a block added at the top of the main file was executed immediately after loading, without any action by the user. It added the SSH key to the enabled key attacker, opened a tunnel exiting to its server (launched approximately every 60 seconds) and was permanently installed on MacOS, Linux and Windows. It also traced the name of the machine, the user, the public IP address, the Git e-mail and the names of some 40 secret-like environment variables — without their values, but enough to spot the positions with cloud identifiers.
On Mac, a verification error often prevented the activation of the SSH service, limiting remote access. Phorion warns, however, that the door remains usable as soon as the remote connection is activated, and that persistence and recognition functioned everywhere.
Read the full article on the original source
Go to the source →