alt Hacker NewsBackdoor in Claude Code for VS Code extension on the Cursor Marketplace
Comments
Do publishers not sign their packages before it gets to Cursor for distribution? Does Cursor itself apply and enforce any package integrity?
Put it inside https://bxsandbox.app
God only knows how many skeletons like this are in Bun now
It looks like they push an update every office day. I'm guessing if I installed 6 months ago and didn't update, that I should be fine?
The descriptions around this are very confusing. Is this specifically the Cursor version, or the regular VS Code version too?
You guys open your editors?
This is a joke (neovim user here).
This is why when I use AI, I still download from the browser and drag and drop the outputted files like a caveman. Sure, it's slower, but it keeps my mental model more up to date and has less security risks. I can even...like read the thing before I run it rather than giving a LLM access to my shell directly. Also anecdotally, it seems more token efficient for those who care about that.
Just uninstalled all the vscode extensions. Dont need any of them anymore.
He says to follow his social, and he provides his handle, but there's no link, and I have no idea how to read it.
I think right now AI is helping the attackers more than it's helping the defenders.
That part is probably obvious.
But in the long term, I suspect this will get worse.
Attackers will still need to think critically to be a few steps ahead of the defenders.
But the defenders will increasingly outsource their thinking to AI as they are incentived if not outright forced to dumb themselves down into interchangeable cogs.
Let me guess, they vibe coded their vibe coding extension?
The extension has over 27 million installs, ouch
That's not official extension though? Misleading title
From https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
Notable customers who run Claude Code and Cursor on laptops include Binance, amongst thousands of others.
Did the Claude Code plugin hack cause the Binance theft? The timing seems like an incredible coincidence.
If it is true that Binance was compromised as a result of this, hats off to our new billionaire friend for one hell of a heist.
If the sole purpose of this hack was to steal cryptocurrency, a silver lining might be, as in many similar cases, that if you stay away from that particular dumpster fire you are probably okay. I mean there's still a reverse shell on your machine to fix, but at least nothing of value was lost.
I don't care anymore, how are you supposed to defend yourself against attacks like this? Come and hack me.
Wait till GitHub gets audited, a literal wild west cesspool of vibe-coded exploits with 1000's of fake stars.
This is embarrassing to Anthropic given here that they lack basic security procedures to prevent this and they have gotten themselves hacked to push malware.
Claude Code was already malware, but with this attack you cannot trust the vendor either.
In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.
I never understood the appeal of cursor.com. Isn't Claude Code on the CLI enough? Are people really lazy or incompetent to resort to using other companies for the same AI models?
Third-party package repo is compromised. Everybody curl | bash directly from Dario's web site until a solution can be found.
not just anthropic, my product that used antigravity is also leaked and copied by google, these close ai company will undoubtably steal your code, file and data.
strongly suggest put your valuable work on local llm.
... So business as usual then for VSchode ?
The amount of problems it's had from compromised extensions is ridiculous.
Honestly with AI getting smarter it feels like these kind of attacks will only increase...
What I dont understand is why the hell do these extensions & clis need to update every damn day. clearly there's no new models everyday, what the actual f.
”I've confirmed Binance use Claude Code with this extension.”
Another reason for not using VS Code and derived and all their mess of extensions. I'm glad running Claude Code in Ghostty/Terminal is not affected.
Keep sending all your secrets and giving full control of your devices to Anthropic.
This is fine.
♟
Anthropic is a malware vendor (on many levels of abstraction): confirmed. But plenty of evidence visible to public eye, prior.
I forbid all-things-Anthropic on any machine I control, as of many months ago. In my private vendor "DNP" blacklist. Its designed as bait for the gullible or ignorant: the telltales are all right there. (Just like OpenClaw, for example.)
> I was working on the clearly mistaken impression that "Made by Anthropic" in the cursor store meant that the artifact had been signed by Anthropic. If that is not the case, then two party's need to get their act together:
Whoa! WTF? I always thought those were official releases by the companies. That's the only reason I trusted them. How is it possible they are being branded as official releases?
It's dangerous to go alone, take this [1]
[1] https://github.com/cookiengineer/check-claude-code-exfil
Imagine backdooring 50+ million installs.
Hats off to the hackers.
"Software is solved. Bugs are not yet solved"
Felix from Anthropic here.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
[flagged]
[dead]
[dead]
[dead]
[flagged]
[flagged]
[flagged]
[flagged]
You can set a cooldown for Cursor extensions
1. Open Cursor.
2. Press Ctrl + Shift + P.
3. Search for Preferences: Open User Settings (JSON).
4. Add:
{