The key points are temporarily unavailable. You can still read the full Story below.
Main Points
An infected version of the Claude Code extension for the Cursor code editor was available on the platform's marketplace for approximately 11 hours on October 29, potentially affecting up to 5,000 developers. The malicious version, identified as 2.1.313, was active between 02:27 and 13:35 Pacific Time. According to reports from WIRED, The Hacker News, and Dark Reading, the compromised extension attempted to establish a persistent SSH backdoor. The code sought to insert a key into the user's authorized_keys file, create a reverse tunnel to servers controlled by the attackers, and exfiltrate data from the host machine. Security experts, including Calum Hall of Phorion, noted that a flaw in the malicious code—which required administrative privileges to execute—prevented the infection from successfully deploying in the vast majority of cases. It remains unclear how the attackers gained unauthorized access to the Cursor extension marketplace. Anthropic, the developer of Claude Code, has denied any compromise of its internal systems. Felix Rieseberg, a representative for the company, confirmed this stance on the social media platform X. A clean version of the extension, 2.1.314, has since been released and is available on the Open VSX and Microsoft marketplaces. Security analysts advise developers who may have installed version 2.1.313 to update their software immediately and inspect their SSH configuration files for any unauthorized keys or entries. The incident highlights ongoing concerns regarding software supply chain security within AI-powered development tools. Article source: 24 Orë | Image credit: 24 Orë
An infected version of the Claude Code extension for the Cursor code editor was available on the platform’s marketplace for approximately 11 hours on October 29, potentially affecting up to 5,000 developers. The malicious version, identified as 2.1.313, was active between 02:27 and 13:35 Pacific Time. According to reports from WIRED, The Hacker News, and Dark Reading, the compromised extension attempted to establish a persistent SSH backdoor. The code sought to insert a key into the user’s authorized_keys file, create a reverse tunnel to servers controlled by the attackers, and exfiltrate data from the host machine. Security experts, including Calum Hall of Phorion, noted that a flaw in the malicious code—which required administrative privileges to execute—prevented the infection from successfully deploying in the vast majority of cases. It remains unclear how the attackers gained unauthorized access to the Cursor extension marketplace. Anthropic, the developer of Claude Code, has denied any compromise of its internal systems. Felix Rieseberg, a representative for the company, confirmed this stance on the social media platform X. A clean version of the extension, 2.1.314, has since been released and is available on the Open VSX and Microsoft marketplaces. Security analysts advise developers who may have installed version 2.1.313 to update their software immediately and inspect their SSH configuration files for any unauthorized keys or entries. The incident highlights ongoing concerns regarding software supply chain security within AI-powered development tools.
News Desk is the editorial publishing account for Tringlobe Media News, covering breaking news, public affairs, entertainment, community developments and regional stories across Trinidad and Tobago, the Caribbean and internationally.
