How did the backdoored extension get published on Cursor's marketplace?

Attackers registered a typosquatted publisher handle mimicking Anthropic's verified identity and uploaded an extension bundling genuine Claude Code hooks with obfuscated telemetry scripts.

What developer data was compromised by the malicious extension?

The payload hooked into editor context providers to capture active editor files, prompt history, and environment variables, exfiltrating found API keys and cloud tokens via encrypted outbound HTTPS requests.

How long was the compromised package live before removal?

The malicious extension remained accessible for approximately 11 hours and 45 minutes before automated anomaly detection and security reports triggered revocation.

What actions should developers who installed the extension take immediately?

Affected developers must immediately uninstall the extension, invalidate all environment variables, rotate cloud credentials (AWS, GCP, GitHub, Anthropic, OpenAI), and audit terminal history for executed commands.

Anthropic Extension on Cursor Backdoored in Supply Chain Hack

Supply chain injection targeting developer IDE ecosystems

A sophisticated software supply chain attack struck developer workspaces this week after an adversary published a trojanized Anthropic Claude extension on third-party IDE registries. The malicious package, designed to mimic official Anthropic developer tooling, appeared on the Cursor marketplace and OpenVSX directory, remaining active for nearly 12 hours.

By cloning the metadata, documentation, and icons of legitimate Claude coding assistants, the attacker deceived thousands of software engineers seeking to integrate Anthropic's frontier reasoning models into their local editors. The extension functioned identically to legitimate tooling on the surface, successfully invoking Claude completions while executing stealthy background surveillance.

This incident highlights how modern AI-native development environments have become premier targets for threat actors seeking high-value corporate access through trusted developer machines.

Prompt payload exfiltration and token theft mechanics

Static analysis of the unpacked VSIX bundle revealed obfuscated JavaScript routines concealed within a minified helper module named telemetry-bridge.js. Once activated by the editor, the script attached listeners to the workspace document change events and language server protocol context feeds.

Every time a developer initiated a prompt or asked the assistant to analyze a repository codebase, the script intercepted the entire context payload. It systematically searched the text buffer for regular expression patterns matching API keys, SSH private keys, AWS access tokens, and database connection strings.

Stolen credentials and sensitive prompt snippets were compressed, encrypted using an embedded public key, and transmitted via HTTPS POST requests disguised as routine telemetry pings to an attacker-controlled endpoint hosted on bulletproof infrastructure.

Discovery timeline across Cursor and OpenVSX marketplaces

The anomalous activity was first flagged by security engineers at a cloud infrastructure firm who observed unexpected outbound network connections emanating from local Cursor processes. Traffic inspection revealed encrypted requests routing to an unverified domain rather than Anthropic's official API gateways.

Upon receiving incident reports, the Cursor operations team coordinated with OpenVSX administrators to unpublish the malicious extension and revoke the attacker's publisher credentials. The package was completely pulled from distribution after approximately 11 hours and 45 minutes of availability.

Marketplace telemetry indicates that several thousand active installations occurred during the attack window, primarily affecting developers working across Python, TypeScript, and Go enterprise codebases.

Developer remediation checklist and secret revocation procedures

Development teams who downloaded or updated Claude-related extensions within the past 24 hours must execute immediate incident containment. Begin by auditing installed extensions in Cursor and VS Code to verify the publisher signature matches official verified corporate accounts.

Any developer who ran the compromised extension must assume all credentials accessible in their workspace or shell environment have been exposed. Immediately revoke and regenerate Anthropic API keys, OpenAI keys, GitHub personal access tokens, and cloud identity secrets stored in local .env files.

Additionally, security teams should inspect corporate DNS and firewall logs for outbound traffic directed toward the documented command-and-control indicators of compromise (IoCs) published in the security advisory.

Securing AI agent extensions in enterprise engineering teams

This supply chain breach demonstrates the urgent need for stringent governance around AI agent plugins and IDE extensions. Modern coding assistants execute with broad local privileges, accessing file trees, terminals, and memory buffers that bypass traditional static application security testing.

Enterprise engineering organizations should enforce centralized private extension registries that require multi-stage code signing, dependency auditing, and sandboxed dynamic analysis before plugins are made available to internal developers.

Furthermore, implementing endpoint network isolation tools that restrict developer IDEs from initiating arbitrary outbound connections to non-whitelisted domains can effectively neuter exfiltration channels even when rogue packages execute locally.