A security incident was recently identified involving a specific extension package in the OpenVSX marketplace, which serves as the extension repository for the Cursor code editor. The affected package was a maliciously modified version of Anthropic's Claude Code extension (version 2.1.313). According to reports from Cursor, this version was not developed by Anthropic and was used to deliver a remote access trojan via an SSH reverse backdoor. Cursor estimated that at most 5,000 users were affected by this specific malicious package.
Discussion on Hacker News centered on the scope of the breach and the specific actors involved. Some commenters noted that while the initial reports suggested a broad hack of Anthropic, the evidence points more specifically to a compromise of the publishing process for the Claude Code extension. One commenter pointed out that Cursor uses the OpenVSX marketplace because the official Microsoft VS Code marketplace is restricted to the proprietary VS Code release. Another commenter highlighted that the affected extension is owned by an Anthropic employee, suggesting that either his specific account or the broader publishing pipeline for Anthropic's extensions was compromised.
The incident highlights the risks associated with third-party extension marketplaces and the potential for supply chain attacks in developer tools. While the number of affected users was relatively small, the presence of an SSH reverse backdoor allows for remote access to a developer's machine. Commenters on Hacker News discussed the implications of such a breach, with some questioning why the AI models themselves did not detect the malicious code and others expressing concern over the security of secrets shared with AI service providers. It remains unclear whether the breach was a targeted attack on Anthropic's infrastructure or a compromise of a specific developer's credentials used to upload the extension.