On this page · 4 sections ▾
A supply chain attack compromises something people already trust, such as a software update, a package or an extension, instead of attacking each victim directly. The attacker slips malicious code into that trusted channel, and users install it willingly or receive it automatically. That is what happened with a tampered Claude Code extension in Cursor's marketplace, which Cursor said affected "at most 5,000 users."
What happened in this case?
As Ars Technica reported, version 2.1.313 of the Claude Code extension for VS Code was posted to Anthropic's official account on Cursor's marketplace. It replaced the previous version, 2.1.312. According to The Register, it was available for around 11 hours on Thursday.
Anthropic says its own systems and employee laptops were not compromised. Its staff member Felix Rieseberg said a malicious actor used access to Cursor's marketplace to publish a tampered copy. Neither company has explained how the attacker gained that access.
Why are extensions a good target?
An extension is a small program that adds features to a code editor. Once installed, it runs with the permissions of the editor itself. Ars Technica noted that this likely gives a backdoored extension access to local files, source code and developer tooling.
Developers also tend to keep valuable things on their machines: cloud credentials, API tokens and access to private code. Compromising one developer can open a path into a whole company.
Auto-update adds to the risk. Phorion's CTO Luke Roberts told Ars that extensions in Cursor update automatically by default, though users can change this. A malicious version can therefore spread without anyone clicking anything.
What did this backdoor try to do?
According to Cursor, the code first collected details about the machine and user, including username, Git email and public IP address. It also sent the names of environment variables, which The Next Web said covered up to 40 matching keys, tokens and secrets, though not their values. Phorion said this lets an attacker quickly see which machines hold cloud credentials worth pursuing.
It then tried to add the attacker's SSH key, turn on the local SSH service and open a reverse SSH tunnel. SSH is a standard way to log in to a computer remotely. A reverse tunnel makes the victim's machine connect out to the attacker, which usually gets past firewalls that block incoming connections.
