Skip to content
kinkeep.dev
Fake Claude Code

A fake Claude Code extension shipped on Cursor's marketplace

Issue 8

  1. A fake Claude Code extension shipped on Cursor's marketplace

    1. 10/28 05:26
      Real 2.1.312 publishedConfirmed
    2. 10/29 18:27
      Tampered copies go liveConfirmed
    3. 10/30 05:35
      Pulled, keys rotatedConfirmed
    4. 10/30 09:12
      2.1.314 publishedConfirmed
    5. 10/30 13:45
      Expel confirms infectionConfirmed
    6. 10/30 16:46
      Cursor posts on XConfirmed
    7. 10/30 19:08
      Verified account claimClaim
    8. 11/03
      Entry path unstatedNone yet

    ConfirmedClaimNone yet

    Versions 2.1.312 and 2.1.313 of the Claude Code extension on Cursor's marketplace were tampered copies Anthropic did not build. The impact is at most 5000 users.

    • The attacker reused the version number of the real 2.1.312. The 2.1.312 and 2.1.313 files on the marketplace are copies Anthropic did not build. On October 31 the notice added this 2.1.312 to the malicious list.
    • Cursor serves extensions from marketplace.cursorapi.com, not straight from Open VSX. Socket found no publication or removal event for 2.1.313. DoublePulsar's verified account claim does not match those records.
    • Phorion reported an SSH key, a reverse tunnel, persistence, and environment variable names. Its first writeup named Open VSX, then corrected that to Cursor. Expel confirmed infections on four Macs after the window closed.
    • The tampered copies were not on the VS Code Marketplace, Open VSX, or npm. Anthropic engineer ddworken and Microsoft confirmed that the official channels were not affected.
    • Check ~/.ssh/authorized_keys. Update the extension to 2.1.314 or later. Rotate credentials if a machine was affected.
    • On Hacker News (1,007 points, 553 comments) the top themes were signing, auto-update delay, and whose key was used to publish. Cursor and Anthropic have not said how many real intrusions there were.
    Felix Rieseberg
    Felix Rieseberg
    @felixrieseberg
    ·Follow

    We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our Show more

    Cursor
    Cursor
    SpaceX Super Intelligence
    @cursor_ai

    We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions

    807
    Reply
    Read 58 replies

    Source: Cursor security notice ↗

    My take

    I use Claude Code only as the terminal CLI. I do not run it as the Cursor extension. This tampered copy did not reach me. Extension auto-update settings stay as they are. I already went through a LiteLLM supply-chain incident. That write-up is in this post.

EN/KO