Treat every AI IDE's extension marketplace as an open supply-chain hole

On 29 October 2026, from about 2:27am to 1:35pm Pacific, anyone installing or updating Anthropic’s Claude Code extension in Cursor’s marketplace could have received version 2.1.313. Cursor says Anthropic did not build that version. According to Phorion’s teardown, the build ran its payload as soon as Node loaded the file, before the extension’s activate callback. It appended an attacker’s Ed25519 key to ~/.ssh/authorized_keys and opened a reverse SSH tunnel to an attacker-controlled server on port 22. It wrote a LaunchAgent called com.apple.sysmond and posted the names of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP. Cursor puts the exposure at a maximum of 5,000 users.

My view is that the extension stores attached to VS Code forks distribute code that the named publisher never signed off. Until Cursor, Windsurf, Google Antigravity and Trae publish how many of their listings carry a publisher’s name without that publisher’s involvement, I am treating every AI IDE on my machine as an unaudited supply chain.

When I opened Phorion’s write-up I expected a typosquat, something like a misspelt Anthropic with a convincing icon. OX Security describes something else: the build went out under the real Anthropic.claude-code identifier. Anthropic’s statement says “we were not involved with building, publishing, or hosting this”, and attributes the upload to a malicious actor who used access to Cursor’s marketplace. The publisher field is the one thing a careful developer checks before clicking install. Here it showed the right name on code the named publisher had never seen. A typosquat at least makes the attacker beat your eyesight. Here Cursor’s own listing told users the code came from Anthropic.

The accounts of how it happened also disagree. StepSecurity says 2.1.313 was published to Open VSX and reached Cursor through mirroring. Cursor’s notice places the build in its own marketplace, and OpenSourceMalware says Cursor told it the origin was not Open VSX. A day after the incident, the company running the pipeline and the firms analysing it could not publicly agree on which registry served the file. If each build carried a signed provenance record, answering that would take a single lookup.

This is the third marketplace failure of this kind in about a year. In October 2025 Wiz found more than 100 extensions leaking VS Code Marketplace tokens, covering over 85,000 installs, and 30 extensions leaking Open VSX tokens, with at least 100,000 installs between them. Wiz’s Rami McCarthy pointed out that a leaked token lets an attacker push an update to the whole install base. In late November 2025 Koi Security reported that Cursor, Windsurf, Antigravity and Trae recommended extensions that did not exist on Open VSX. Koi claimed those names with harmless placeholders, and more than 1,000 developers installed them because their editor suggested it. Koi says Windsurf never replied. Each route ends at an extension host running with your user’s permissions, with your source tree, your SSH directory and your shell within reach.

There is a fair case that this one fizzled. Cursor says the step that turns SSH on would fail except where Cursor had been started with administrator rights. Phorion shows why on macOS: the malware runs systemsetup -getremotelogin without elevation, which as a standard user prints an administrator-access error and exits with status 0, so the /Off/ regex never matches and the enable command never runs. Cursor pulled the build and then shut its whole marketplace as a precaution. After the 2025 token leaks, the Eclipse Foundation revoked the tokens and promised scanning at publish time.

I accept all of that, and I don’t think it settles anything. The bug protected Macs where Remote Login was off. It did nothing for Macs where it was already on, and according to Phorion the key, the LaunchAgent and the beacon were installed regardless. Fixing the macOS check is a one-line job for whoever ships the next attempt. Publish-time scanning looks for embedded secrets and known bad patterns. This payload was a prepended function importing child_process, fs, os and http, modules plenty of legitimate extensions also import. Eclipse says the token leaks were developer mistakes and not an infrastructure compromise. That is accurate, but a user looking at the install button cannot tell the two apart.

If you ran Cursor during that window, check for ~/Library/LaunchAgents/com.apple.sysmond.plist, ~/.config/.smt and /tmp/.stk_* files. Phorion notes the malware looks for the svc-telemetry comment and not the key itself, so check authorized_keys by key fingerprint as well as by comment. Look in your SSH logs for logins from 127.0.0.1 or ::1 using that key, which is how an operator’s session would appear. Uninstalling the extension removes none of these artefacts. Then disable automatic extension updates in every fork you use and pin each extension to a version you have chosen yourself, so the next 2.1.313 has to get past a person before it runs on your machine.

Prompted by Official Claude Code Extension Compromise: Security Advisory | Phorion, Phorion | macOS Endpoint Detection and Response (EDR).