Tampered version distributed for about 11 hours
Cursor, the U.S. maker of an AI coding tool, said on Oct. 29 (Oct. 30 Japan time) that a tampered version of Anthropic's "Claude Code" extension had been distributed on the extension store for its editor. It was distributed for about 11 hours on Oct. 29, from around 2:27 a.m. to around 1:35 p.m. Pacific time, and up to about 5,000 users may have installed it, the company said. Cursor said the tampered version was not made by Anthropic.
The tampered version was 2.1.313, and only installations from Cursor's store are affected. Versions distributed through Anthropic's official npm package, Open VSX and Microsoft's Visual Studio Marketplace were not affected.
Attempted entry through SSH
When the extension started, the tampered version ran a program of about 66 lines before the legitimate code. It collected information such as the device name, user name, operating system, public IP address and Git email address, and tried to add the attacker's public key to the list of authorized SSH keys so the attacker could get in from outside. It also planted mechanisms on macOS, Linux and Windows to keep running after a restart. It hid errors so that the extension itself worked as usual.
According to Cursor, the step to enable SSH requires administrator privileges, so it likely failed on many devices. However, whether an attacker actually got in can only be determined by checking each device.
Store shut down and rebuilt
Cursor removed the tampered version and stopped its distribution, and as a precaution shut down the entire store, rebuilt it and reopened it. It said it also rotated the store's credentials and that the attacker's server had been taken down. The company said other extensions were not affected.
It is asking users to update the Claude Code extension to version 2.1.314 or later. However, updating does not remove SSH keys or auto-start settings that have already been added. Researchers recommend that anyone who installed 2.1.313 on Oct. 29 check their list of authorized SSH keys and auto-start entries, and rotate their SSH keys and GitHub and cloud credentials.
Developer tool supply chain targeted
Extensions and settings for AI coding tools have direct access to source code and credentials, making them attractive targets for attackers. In October, it also came to light that API keys entrusted to the AI coding tool OpenCode may have been leaked (related article).
