A supply-chain attack was delivered through a tampered copy of a popular code extension available in the Cursor marketplace for several hours. The malicious package, identified as versions 2.1.313 and 2.1.312 of the Claude Code extension, was distributed exclusively via this specific platform. Evidence indicates that the official distribution channels for the extension, including the Microsoft Visual Studio Marketplace and the npm registry, were not compromised. The incident is currently limited to the Cursor ecosystem, with no confirmed impact on other platforms. Users who installed or automatically updated to these specific versions during the exposure window are at risk of unauthorized access and data collection. The threat poses a significant risk to developers using this code editor, as the malicious code executes silently within a trusted development environment, potentially exposing sensitive host information and establishing persistent remote access without immediate user awareness.
The injected JavaScript loader executes before the extension’s normal initialization, using Node.js APIs to gather host reconnaissance data such as hostname, username, and operating system details. It specifically targets environment variable names containing terms like KEY, TOKEN, or SECRET, collecting up to forty matches to identify potential credential storage locations. The loader then appends an embedded public key to the user’s SSH authorization file, creating a marker for attacker access. It enables the local SSH service and establishes a reverse tunnel to a remote server, allowing the attacker to reach the workstation’s local SSH port from an external location. Persistence is achieved through platform-specific mechanisms, including macOS LaunchAgents, Linux cron jobs, and Windows scheduled tasks, which use deceptive names resembling legitimate monitoring tools. The loader suppresses command output and catches errors to avoid detection, while the extension continues to function normally. A delayed callback transmits the collected host details and environment variable names to the attacker, though the actual values of the secrets are not exfiltrated by this specific mechanism.[/subscribe_to_unlock_form]
A supply-chain attack was delivered through a tampered copy of a popular code extension available in the Cursor marketplace for several hours. The malicious package, identified as versions 2.1.313 and 2.1.312 of the Claude Code extension, was distributed exclusively via this specific platform. Evidence indicates that the official distribution channels for the extension, including the Microsoft Visual Studio Marketplace and the npm registry, were not compromised. The incident is currently limited to the Cursor ecosystem, with no confirmed impact on other platforms. Users who installed or automatically updated to these specific versions during the exposure window are at risk of unauthorized access and data collection. The threat poses a significant risk to developers using this code editor, as the malicious code executes silently within a trusted development environment, potentially exposing sensitive host information and establishing persistent remote access without immediate user awareness.
The injected JavaScript loader executes before the extension’s normal initialization, using Node.js APIs to gather host reconnaissance data such as hostname, username, and operating system details. It specifically targets environment variable names containing terms like KEY, TOKEN, or SECRET, collecting up to forty matches to identify potential credential storage locations. The loader then appends an embedded public key to the user’s SSH authorization file, creating a marker for attacker access. It enables the local SSH service and establishes a reverse tunnel to a remote server, allowing the attacker to reach the workstation’s local SSH port from an external location. Persistence is achieved through platform-specific mechanisms, including macOS LaunchAgents, Linux cron jobs, and Windows scheduled tasks, which use deceptive names resembling legitimate monitoring tools. The loader suppresses command output and catches errors to avoid detection, while the extension continues to function normally. A delayed callback transmits the collected host details and environment variable names to the attacker, though the actual values of the secrets are not exfiltrated by this specific mechanism.[emaillocker id="1283"]
The incident highlights the growing risk of supply-chain attacks targeting development tools and extension marketplaces. While the specific threat actor remains unidentified, the campaign demonstrates a clear intent to establish persistent remote access and gather reconnaissance data from developer environments. The scale of the attack is limited to the Cursor marketplace, but the potential impact on individual users is significant due to the sensitive nature of the targeted data. Defensive implications include the need for organizations to monitor extension installations, review endpoint telemetry for unauthorized SSH activity, and implement strict controls on extension sources. Users should verify the integrity of installed extensions, remove any suspicious artifacts, and rotate credentials if exposure is suspected. This incident underscores the importance of continuous monitoring and rapid response capabilities in mitigating threats that exploit trusted software distribution channels.
We recommend you to update Zimbra Collaboration Suite to version 10.1.20.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Execution | T1059.004 | Command and Scripting Interpreter | Unix Shell |
| Execution | T1059.001 | Command and Scripting Interpreter | PowerShell |
| Persistence | T1098.004 | Account Manipulation | SSH Authorized Keys |
| Persistence | T1053.003 | Scheduled Task/Job | Cron |
| Persistence | T1053.005 | Scheduled Task/Job | Scheduled Task |
| Defense Evasion | T1055.001 | Process Injection | Dynamic Code |
| Defense Evasion | T1070.004 | Indicator Removal | File Deletion |
| Defense Evasion | T1562.001 | Impair Defenses | Disable or Modify Tools |
| Defense Evasion | T1070.001 | Indicator Removal | Clear Windows Event Logs |
| Defense Evasion | T1562.006 | Impair Defenses | Indicator Blocking |
| Discovery | T1082 | System Information Discovery | - |
| Command and Control | T1572 | Protocol Tunneling | - |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Exfiltration | E1020 | Automated Exfiltration |
The following reports contain further technical details:
[/emaillocker]