Felix from Anthropic here.
We’re working with Cursor on this incident, but it wasn’t a compromise of Anthropic’s systems or employee laptops. A malicious actor used access to Cursor’s marketplace to publish a tampered copy of the Claude Code extension, which we didn’t build or publish. The versions on our official channels are not affected and this only impacts Cursor users.
You can say that this isn't compromise of Anthropic, but it sort of is in the setup. Cursor Claude extension is marked as something made by Anthropic, so default assumption is that only people who can release that new extension would be a team at Anthropic.
Since that is clearly not the case, that is just as much Anthropic's problem as it is Cursor's problem. There either needs to be a technical change so that extensions are signed with keys that Anthropic controls, or you should take the branding off from the Cursor extensions.
That's nonsense. If what felixrieseberg said is true this is very clearly a compromise of Cursor and not Anthropic. Trying to spin it as a compromise of Anthropic is absurd.
+1.
HN has a dedicated upvote functionality.
I think he's saying (erroneously) Anthropic owns Cursor. Reading this claude.com page [1] hawking Cursor you could be forgiven for forming that impression.
[1]: https://claude.com/marketplace/agents-products/cursor
I don't think they're trying to spin this as Anthropic being compromised, but I do think they're correct in saying this is Anthropic's problem to deal with now, regardless of the fact that they're not responsible for the root cause.
It’s like if 5,000 people bought iPhones at Costco and they all exploded, and Apple says “well we didn’t sell them.” Sure, but maybe not the perfect thing to communicate immediately.
It's literally not like that at all.
If Costco made iPhones under license from Apple outside of the Apple supply chain and they all exploded, while the Apple name is involved they have no direct liability or responsibility.
Legal responsibility, no. But apple's reputation would nevertheless be on the line. Is this situation I would expect Apple to pursue legal action against Costco for reputational damage, as I would Anthropic Cursor.
No, it's like 5,000 people bought something that Costco called the iPhone but really was EvilPhone Max+ by EvilCorp. Costco should be on the hook for accepting the phones without properly checking they weren't bombs in disguise.
Apple would be 100% right to say "they're not our phone, we didn't make them, the branding was a lie."
Of course if Cursor actually has a direct connection with Anthropic, and Anthropic lost control of their keys... it's a different story and their employee is just obfuscating up there.
It's a lot more like a bunch of people bought Cisco networking equipment and then the NSA secretly intercepted shipments, implanted surveillance backdoors, then resealed the boxes and sent them on to unsuspecting overseas targets.
If there are no seals at all then it’s hard to argue this is the correct analogy.
And there was no interception. At the very strongest, the bad guys convinced Cisco to ship the stuff, and Cisco is saying it’s not their responsibility.
They definitely shipped something they didn’t build or check.
This is misleading; a better analogy would be if someone swapped out all iPhones in the store with fake ones.
In this situation, Cursor did not make any reasonable attempts to check this extension really was from anthropic.
So for the analogy, it really is like Costco didn't make any attempt to check they were buying actual iPhones.
A better analogy would be to say Anthropic must register their domain with every TLD available, to prevent someone cybersquatting it. I see Claude.org.nz is available.
That is not what was written; what was described was anthropic losing control over their cursor account - perhaps a key compromise, developer laptop compromise, or a fault in cursor, but of the three, the language suggests the first two.
This is wrong.
If you decided to use an umbrella to protect something during a hurricane and umbrella breaks and your thing is ruined. Whose fault is that?
Distributing signed artifacts is a solved problem (until NP=P is cracked at least).
Are you claiming that the Cursor extension store - marketplace.cursorapi.com - does not add their own proxy to Open VSX?
One thing at a time. Please just answer this one question. I am just some dude, and I would love to chat about this.
That is simply not how software works.
From the producer's side, sure, we[1]'re all pretty sympathetic to the fact that if you publish a library a bunch of random people will build bridging libraries for languages that you have no control over.
But from the consumer's side it is very much an expectation and if you find yourself in the situation above it's on you to make it very clear that such extensions and third party tools are unofficial.
In this particular case I think it's fair to say that Anthropic really dropped the ball on signaling that this was an unofficial third party tool.
1. We specifically being library and tool producers that are noticeably overrepresented on this forum.
> Anthropic really dropped the ball on signaling that this was an unofficial third party tool
Had the tool been up longer than the 11 hours the malware was live? If not, then why would Anthropic try to get it marked as unofficial, as opposed to take it down?
Or are you saying that every author and publisher should request Cursor to mark their extensions on the Cursor vsx pass-through as unofficial?
The issue could be resolved by introducing some sort of signing for openvsx extension packages. Then regardless of from where one downloaded Claude, it can be always verified to be authentic or not. This technology exists for ages and prominently featured in all mainstream Linux distributions. Cursor, Anthropic and other openvsx users need to work with Eclipse Foundation to make this happen.
Cursor should not be shipping extensions that are branded Anthropic if Anthropic didn’t create that extension. If that’s really what happened then that needs to change, ASAP. Now that it has happened, IMHO, it is partly an Anthropic problem: the malware has their branding and their name on it, I don’t think they can just brush that off.
Does Cursor have some process that just scrapes Microsoft’s extension catalog and lists them in their own? If that’s hostile works then it’s broken and needs to be fixed.
> Cursor should not be shipping extensions that are branded Anthropic if Anthropic didn’t create that extension.
Well, duh. From what I can tell, that’s literally the hack. A bad actor shipped an extension on the Cursor marketplace that wasn’t made by Anthropic.
No, you misunderstand (not surprising since 99% of the coverage on this story is wrong). What happened is: someone published an extension called "Anthropic.claude-code". That someone was not Anthropic and never was Anthropic. They just used the string "Anthropic" in the name of their extension. The comment you are responding to is saying that Cursor (the organization that manages the extension marketplace) should have prohibited someone from using a popular AI lab's name in the title of their mystery meat extension. They're probably right about that.
I think GP’s objection to the claim that Cursor allowing non-Anthropic to do it for 11 hours was partly “an Anthropic problem.”
It is an Anthropic problem. It's also a Cursor problem.
I'm on my phone, "If that’s hostile works.." should be "If that’s how it works..."
I mean the initial translation kind of works too.
I was working on the clearly mistaken impression that "Made by Anthropic" in the cursor store meant that the artifact had been signed by Anthropic. If that is not the case, then two party's need to get their act together:
Until that happens - it's almost like you have to delete any extension from the Cursor Store off of your Cursor instance - kind of a crapshoot what you are actually downloading, no?
For example - what guarantee do I have with something like: " This publisher has verified ownership of cursor.com" - when I'm looking at the WSL extension. Are there any guarantees it's not been replaced with some other extension?
The core problem is that VScode extensions does not need to be signed at all. Mind boggling stupid design decision.
Isn't the Cursor Marketplace separate from VSCode's? Maybe it's as simple as someone impersonating Anthropic because they never registered there? Code signing alone wouldn't help in cases like that.
Vendor A publishes a public key on their site for authenticating any signature. There is an entire subset of cryptography dedicated to addressing these needs. This is just yet another software player, Cursor, taking the absolutely easy no effort path because otherwise they would be, I don't know, "losers". I mean only losers would setup a basic authenticated provinance for bits of code they are pushing to the world to be executed by all and sundry. Really, this profession has become a complete clown show.
I don't think even VSCode does this. Probably not even any package managers I know of? Code signing, yes, but not for organization verification? It's pretty much like a username - anyone can claim it if it is unclaimed?
edit: VSCode has a verified marker for publishers but I don't know how that works or if Cursor does the same.
This is a solved problem, just look at how EFF's certbot works. You cannot just claim that you are porn.com unless you put a payload there that matches what the bot expects.
And force everyone who wants to publish an extension to buy and manage a domain name? What if it expires? You're just replacing one set of problems with another.
You could make it a requirement only for people who want to attribute “made by”. If you publish a no name extension, you could skip it.
> Code signing, yes, but not for organization verification
They don’t do organization verification, but they do verify where code comes from. You may be sure that packages are built by alpine, which made sure that the dist files comes from the sources that the maintainers added, and the latter ensure that the sources are correct. In truth, it’s a very small circle of trust.
> Really, this profession has become a complete clown show.
Always has been because there is so far zero liability for anything someone programs and distributes commercially. That's the single root cause. If not that software wouldn't be in general such major shit show. What we have is the result of being allowed to throw out even the most toxic shit out without any consequences if it causes damage, no mater how large the damage is. Software companies caused so far over the decades likely hundreds of billions, or even a few trillion damages in sum, yet nobody responsible ever got the bill. It's wild west—since now over 60 years. This has to stop finally!
Let's see where things will move as soon as we have regular product liability for software:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum...
Just a few days left! Looking forward.
That, and NIS2. Looks like a good trend, hopefully it's not just protectionism.
Well, if something than it's "anti-protectionism".
This is going to cause some major argument between the EU and the US, maybe even a trade war. Trouble is already underway:
https://www.reuters.com/legal/government/us-lawmakers-urge-t...
Despite that I also think that this is the right and long overdue move on the EU side. We need to break the basic pattern that nobody cares as long as the responsible effectively never get the bill when they mess up.
Software is "Unsafe at Any Speed" [ https://en.wikipedia.org/wiki/Unsafe_at_Any_Speed ] to bring a striking analogy — even we have since about 60 years the tech to build software which provably (in the mathematical sense) matches its specification. Still what you have on the market is utter garbage, and instead of getting better it gets currently actually worse with lowering the garbage quality level even more with "AI" slop. That EU legislation could become the escape hatch; that's why I'm looking forward.
I'm having trouble understanding what effects that directive could have. Liability under what circumstances and to what degree?
i work for a large company that’s trying to curate vs code extensions, and this doesn’t make it easy.
we automatically block extensions and require that extensions must be approved, but this is a tedious process.
Is there finally a use for blockchain?
No, that is already solved by gpg.
Stop trying to make blockchain happen, it's not going to happen.
Using it for voting would probably be useful for the blockchain, but then the downside would be the potential loss of privacy.
You want an AI company to care about IP? And you aren't being sarcastic?
Leading companies need to be proactive in reducing these surface areas. For example, if anyone can submit an agent skill, plugin, or MCP server with Anthropic or OpenAI's name into a marketplace, it is an attack vector.
Anthropic is desperately dependent on SpaceXSI's compute (which either party can cancel without cause, on short notice), they can't really tell SpaceXSI to do anything without ruining their IPO; or more Claude outages leading to users flocking to OpenAI, etc.
The situation is confusing, so can I please confirm the following:
* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?
Even more confusing is apparently Cursor Marketplace is OpenVSX + their own proxy to add extensions on top[0], so there are at least two possible cases:
1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it
2. The compromised version was on Cursor's proxy, not OpenVSX itself
[0] https://cursor.com/help/customization/extensions
It wasn't on OpenVSX according to https://news.ycombinator.com/item?id=50305148
Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.
I am curious to see how difficult it will be to get this message across on Twitter. $44B seems like a bargain at this point.
Huh?
He's implying that twitter will shadow ban this info to let anthropic reputation be damaged for a few more days
This is not directed at you personally but Anthropic (and everyone around this debacle) in general: please put some real effort behind planned crisis communications. The reporting on this has been atrocious and the comms coming from Anthropic have not really helped.
FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"
Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.
Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.
Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.
You're confused. It's not Anthropic's responsibility to monitor and fix everything that's said correctly or incorrectly about them. They're doing excellent given what they're capable to do in this situation.
Yeah, but every now and then someone working for Anthropic tweets something, everyone quotes it as gospel, but there's no official statement anywhere on their website. They have the worst communication ever, it's one of the things I like the least about Anthropic.
It’s strictly speaking not their responsibility, but it is something that they should do if they want to help their customers.
In general, they need to make a really big post somewhere that’s not a HN comment that this was in fact a compromise of the Cursor marketplace, not an employee’s machine, because they’re getting a lot of (unjustified) bad PR.
No but their no doubt highly paid lawyers should have sought relief from their trademark being infringed, and demanded the extension was pulled long ago.
They didn't because they were benefitting from the situation. (Users got to use their preferred tooling.) Until they weren't. That makes it more their problem, in my mind.
You run a business and have millions of high paying customers. Someone happens to use your brand to market things and create harm for the society. Legally, you may be clean. But, your first line of defense is not "it is not my problem".
They're not obligated to. I'm not obligated to be a customer.
> But Anthropic (and everyone around this debacle) in general: please put some real effort behind planned crisis communications. The reporting on this has been atrocious and the comms coming from Anthropic have not really helped.
Anthropic is incapable of communicating. They rely on random employees in random threads on random social media to do some kind of PR and posts. Regardless of the issue. Or even non-issues but features.
Anthropic needs to issue a cease and desist to Cursor for claiming official “by Anthropic” extensions they don’t make or control.
They would have done this in a heartbeat to anyone that they’re not reliant on for compute.
there is NO LEGIT v2.1.313
here is the ddworken comment confirming https://news.ycombinator.com/item?id=50300683#50305148
My guess is someone published an extension on vscode/cursor claiming to be Anthropic when it wasn't. Kind of like me publishing an app called Youtube on the app store, being accepted by Apple and having people download my malicious app called Youtube.
There's been too much guessing already. Anthropic employees answered in this thread almost 4h before your response.
Ok, so... Summing this up
- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)
Apparently it is public: https://cursor.com/help/customization/extensions
They use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.
Ironically, that page has a paragraph "How Cursor reduces supply-chain risk:"
Which is exactly the opposite of what happened today.
well maybe they did reduce supply chain risk, but still need to reduce it some more
> Team admins can defer extension installs and updates until a marketplace version has been published for a minimum number of hours.
I think everyone is going to be setting this to 168 after today.
Yes. Cursor marketplace is a mirror of Open VSX except they inject some plugins that are not in Open VSX for some reason. This works because Open VSX has basically no security. Which was already an issue.
If this isn't a damning indictment of Cursor, I don't know what is. Perhaps it will be the death knell.
What value is this VS fork actually adding given today's advanced harnesses? Surely whatever benefits it offers are not worth the risks going forward.
I believe the value add was $60bn in just 4 years https://www.linkedin.com/posts/sytaylor_wild-cursor-just-sol...
I dont know a single person who uses this tool (but im sure there are some) our annual subs recently ran out, I hadnt used mine in 6 months, we did not renew.
Elon did the typical boomer tech guy thing when they interact with any slightly impressive AI tool.. Lose their fkn mind and spend tons of money on it. He just took it to another level..
Its like those tech boomers that got obsessed with openclaw and instantly started spending 20k a month on a thing that read their calender outloud to them.
Cursor made Grok Bot and is working on the Grok models.
I wouldn't say it's obviously unsuccessful.
The team behind Cursor and their data were worth $60 billion to Musk, not the app itself.
Considering that the biggest and most successful play for SpaceXAI in the AI space has been "Sell compute to Anthropic" I also wouldn't say that all of the grok junk has been obviously successful, either.
>Perhaps it will be the death knell
People said the same thing about SolarWinds, Lenovo (Superfish), CrowdStrike... Nothing will happen.
I'm still surprised people use CrowdStrike. I guess there are no real alternatives. I know companies are getting CrowdStrike alerts for this very issue, but it still just seems like a MASSIVE attack surface.
Back when I was in DevOps, the Linux Falcon Sensor was an absolutely disaster. They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently), the service ran as root, it UPDATED ITS OWN BINARIES as root! It broke nearly ever Linux design philosophy.
I know newer version use eBPF and don't have the stupid kernel lock-in issue, but I still don't trust it.
> I'm still surprised people use CrowdStrike
I mean, LastPass is still in business...
> > I'm still surprised people use CrowdStrike
> I mean, LastPass is still in business...
I mean, Microsoft is still experiencing massive growth.
If Microsoft was any good the entire IT industry would collapse. Millions of high paying careers are built on decades of fixing the garbage that comes out of Redmond. Probably a trillion dollars worth of businesses selling software and support to companies running Microsoft would evaporate as soon as Microsoft doesn’t continue their current efforts.
If I had to guess it's that very few people use it for actual security guarantees and most use it just to be able to fill out the questionnaire or compliance box saying "we do this".
I remember when Crowdstrike was all about mobilizing your spare computer to DDOS the bad guys.
I had to fill a security questionnaire today. One of the questions was
"Do you use crowdstrike falcon?"
What do you suggest instead ?
Their Linux stuff has gotten much better but besides the (insanely huge) recent windows debacle I've found them to be a great product
> They recompiled it for EVERY kernel release of every supported distribution (they had never heard of DPMS apparently)
Neither have I, I think you goofed up on your acronyms? For a driver as embedded as crowdstrike you need to recompile, there's no other way around it. Linux doesn't provide anything stable to target and a shim won't cut it in this case.
> the service ran as root, it UPDATED ITS OWN BINARIES as root!
Would you prefer if Linux allowed local users to replace the kernel and/or its modules without root? What kind of faux-outrage is this?
I think gp meant DKMS (https://en.wikipedia.org/wiki/Dynamic_Kernel_Module_Support). It allows for things like using same proprietary device drivers across many Linux kernels.
Crowdstrike and Solarwinds are still being used by nearly every fed govt agency today. It's amazing really that despite everything they still get to suck up our funds.
I forgot entirely about superfish. That takes me back.
My recollection is part of what uncovered it was that the malware broke WebSockets on Lenovo laptops.
I think higher end Lenovo laptops with cleaner windows images were not affected. And a lot of knowledgeable users wipe the OS anyway.
Seeing as SpaceX owns Curser, I’m surprised there wasn’t a hack on SpaceX… Yet
Who says there wasn't?
A lot of the most valuable SpaceX IP (at least to the big "advanced persistent threat" hackers) is probably related to military secrets, information to let you spy on/disable/control star shield/link, and so on. Not things we'd find out about as the general public.
It's highly probable that Russia's top state-controlled hackers have been attempting to exploit/infiltrate SpaceX and Starlink for the past four years.
China has probably being doing so for a decade.
I mean, who says it wasn't an inside job...
https://www.cnbc.com/2026/10/30/binance-hack-elon-musk-tesla...
I realized this earlier this year and dumped Cursor for just vscode along with 20x subs to Claude and OpenAI. Much cheaper and nothing of value was lost.
Cursor was the first AI coding tool I used that had a "wow" factor and got me to switch over from typing out most of my code to having AI write most of it. But then when I used Claude Code for the first time, I never went back to Cursor.
I can see the value in a world where you still want to be a bit more hands-on with your code, but that didn't feel worth paying for anymore. Now if I want to be hands-on I actually prefer a minimalist editor with no AI features at all, while agents run in my terminal.
Yeah, kind of eye raising if people are still using Cursor now days.
I'm assuming there is no way to prevent this without Cursor improving their extension vetting? Seems like folks are confused in the comments here. To me, this is a 3rd party marketplace that lives outside of Anthropic's governance, is that correct?
Dworken from Anthropic here, yes this is correct. This is a third-party marketplace that we are not involved in owning, maintaining, deploying, or reviewing.
Is the extension not Anthropic.claude-code developed by Anthropic? Been a while since I used Cursor.
> Cursor routes extension search and downloads through its own marketplace proxy (marketplace.cursorapi.com), not a direct passthrough to Open VSX.
https://cursor.com/help/customization/extensions
The extensions does not need full access to the laptop.
When you are invited to someone's living room, you don't get to access their bedroom.
The idea that Claude should have full data access to the home directory is wrong. And as an industry leader, Claude has set a bad precedence.
Probably a good idea to only run LLMs with a dedicated user account, or in a container.
Dedicated user account does not work as eventually all your code and data will move under that.
I run it in an ephemeral container sandbox (https://github.com/ashishb/amazing-sandbox) which has access to the current working directory and it drastically limits the attack radius.
That looks really nice, including the VSCode/Mac wrapper.
I’m fine with that. I use a top-level directory for all of my code, and restricting extension access to that directory is a great idea.
It is good but you still don't want long running background tasks.
When you run a linter, for example, then it should stop executing cider once it stops. And not be able to spawn long-running background tasks for infiltration.
If all the code and data eventually move into the dedicated user account, why wouldn't it also eventually move into the container/vm?
Don't mount all your code every time.
E.g. when working on a frontend only project, you don't need to mount the backend directory and vice-versa. This limits the attack radius.
For locally installed Code / Code-fork extensions, there is not any concept of permissions (at least on Windows or MacOS (+ the 3rd party code-server running on Linux)), correct?
It shouldn't.
Be as close as AGI we are (/s), this issue from 2018 is still open:
https://github.com/microsoft/vscode/issues/52116
I don't know what we are doing.
Does it? It asks for permission to use whatever directory you call it in.
I'd suggest stop to use the word 'only' as it can be perceive wrongly here.
you can simply say Cursor users were affected. or exclusively.
just a tip from someone who worked tech support in cyber a long time. choice of words can really help change sentiments in these situations.
'only server xyz was affected' vs. 'server xyz was affected' or 'incident was isolated to server xyz' was often difference between shouting and crying customers or people understanding what was really meant.
>I'd suggest stop to use the word 'only' as it can be perceive wrongly here.
ive been sitting here for a few minutes trying to figure out what the 'wrong' perception here is.
why do people cry if you say "only"?
I think the concern is that it could be seen as minimizing the harm done to those affected, but I personally think this is kind of a hypersensitive overcorrection :P
people have varying degrees of sensitivity and also different defaults when it comes to interpreting phrasing depending on their native language, cultural expressions, current emotional state and more.
its a bad thing to assume that everyone is the same here and have some default reactions.
these are people who in name of company are responding to customer concerns, unlike us who are simply commenting on stuff. its a different context to communicate from.
what do you think will be nhe result if they word things clumsily, people get angry, and then stop their subscriptions. Its not a handy thing to be doing. Big tech can be harsh, ive seen people sacked for less.
Do you have any visibility into why or how only is viewed negatively by some populations? I am still struggling to connect that dot, and I am a native english speaker. But I suspect that may be part of the problem? Are their some languages where the translation of only isn't parsed quite the same or something?
hey, personally i dont mind either, perhaps its because different words are used to frame things differently in different languages. A lot of people here type english but aren't.
I just said this as some unsolicited advice since out of experience i know it makes. a big difference to choose the right phrasing when speaking to people from around the globe.
Nobody seems to be taking responsibility for the alluded-to credential leak. No ownership taken, and no explanation of how the leak occurred or how it will be prevented in the future.
If y'alls systems were not compromised then it was Cursors?
Why was version 2.1.313 silently deleted from OpenVSX, Visual Studio Marketplace and Cursor then?
https://doublepulsar.com/anthropic-hacked-to-deliver-remote-...
I'm guessing it was the easiest quick workaround available, but obv wait for official confirmation.
Reads like Cursor's extension marketplace got compromised, hence how the OpenVSX and MS marketplaces can be unaffected.
313 was never released lol https://github.com/anthropics/claude-code/releases
Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.
Why was the npm version 2.1.313 yanked?
https://www.npmjs.com/package/@anthropic-ai/claude-code?acti...
Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.
Thank you for the clarification and my apologies for misspeaking, as the version indeed does not appear to have been yanked but entirely absent.
Why such stuff isn't signed, like packages in every serious Linux distribution since decades?
smooth sloperators, smooooooooth sloperattorrrrrssss
All these security issues have made me want to build more of my own slimmed down tools. It would be great if there were better ways to use claude code with my own minimal harness and still have access to the pro plan.
> The versions on our official channels are not affected and this only impacts Cursor users.
Is Cursor not an official channel for Claude?
> We’re working with Cursor on this incident
Could be better to say "we're working with the Cursor team on this incident". Not your intent, but I initially understood that the Claude team was using Cursor-the-product (instead of Claude-the-product) to resolve the backdoors.