SCSE-H-C7A29E4B-01ACTIVE
The Oct-29 Cursor event is a confirmed trusted-marketplace distribution of malicious Claude Code-branded extension artifacts.
Publishing root cause remains separate.
جارٍ تحميل البيانات التشغيلية
TOPIC
Cursor Marketplace distribution of malicious anthropic.claude-code 2.1.312/2.1.313: trusted extension identity, bounded exposure window, module-load persistence/SSH-backdoor behavior, publishing-path root cause, realized impact boundary and defensive controls.
2
7
3
8
3
ACTIVE — original SCSE finding unchanged. CY-DOM-006 independently rediscovered the exact incident and was semantic-deduped at closure; no duplicate evidence/confidence added. AIS added a cross-domain follow-up watch while root cause, realized remote-access denominator and actor/post-compromise outcomes remain gated.
DEVELOPER_TOOLCHAIN_MARKETPLACE_SUPPLY_CHAIN
—
—
—
The Oct-29 Cursor event is a confirmed trusted-marketplace distribution of malicious Claude Code-branded extension artifacts.
Publishing root cause remains separate.
Affected extension load can leave SSH key, persistence and reconnaissance even when full tunnel access fails.
Per-host execution and remote-session telemetry.
Potential exposure cannot be converted into a confirmed successful-compromise count.
Install/update + execution + persistence + auth/network denominator.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 7 Evidence
Cursor confirmed malicious versions under the legitimate extension identifier were served from its marketplace and attempted host reconnaissance, SSH-key installation, reverse tunneling and persistence; containment/remediation actions were published.
لا يثبت: Does not prove successful remote access or credential theft on every exposed host; exact publishing root cause remains unknown.
فتح Run المصدرMicrosoft independently confirmed the injected JavaScript chain and scoped the incident away from Microsoft Visual Studio Marketplace/npm; Anthropic confirmed its systems were not compromised.
لا يثبت: Code capability/order does not prove every action succeeded; env-var names are not secret values; host prerequisites matter.
فتح Run المصدرSophos independently documented the malicious extension behavior and remediation need; its reported exposure estimate is retained only as exposure, while code errors are preserved as impact-limiting counterevidence.
لا يثبت: Exposure estimate is not confirmed infection, successful remote access or credential-theft count.
فتح Run المصدرMalicious anthropic.claude-code 2.1.312 and 2.1.313 for macOS/Windows were distributed through Cursor Marketplace on Oct 29; loader attempts SSH-key installation, reverse SSH, persistence and host reconnaissance; Cursor removed packages, audited/rebuilt the marketplace, rotated keys and found no evidence other extensions were tampered with.
لا يثبت: Does not prove publishing-access root cause, successful remote access on every exposed host, actor identity or post-compromise credential abuse.
Independent analysis verifies injected JavaScript executes on extension load, attempts SSH-key installation/reverse forwarding/persistence and reports host details; malicious packages were not distributed via Microsoft Visual Studio Marketplace or npm @anthropic-ai/claude-code, and Anthropic reported its systems were not compromised.
لا يثبت: Does not establish initial Cursor publishing access, successful remote-access denominator or actor attribution.
Independent defensive advisory corroborates SSH-key insertion, reverse-tunnel attempt, persistence and host reporting; notes coding errors block SSH enablement on most macOS/Windows hosts and uninstall alone does not remove persistence.
لا يثبت: Does not independently establish publishing root cause or successful remote-access count.
Earlier Cursor notice named version 2.1.313 and stated at most 5,000 users were affected; later official update expanded scope to 2.1.312 and 2.1.313. Earlier count is retained only as potential exposure context.
لا يثبت: Does not prove 5,000 executions, remote logins or distinct successful compromises; same authority is not independent corroboration.
Exact route by which malicious builds entered Cursor Marketplace is not publicly established.
Authoritative RCA/audit/publisher identity evidence.
Model repositories that can execute custom Python are software-supply-chain boundaries; model weights and repository identity alone are insufficient trust anchors.
Broader ecosystem measurements of custom-code loading paths
Removing the miner alone can be insufficient where campaign builds also establish SSH/reverse-shell access or startup persistence.
Host-level artifact/auth/network evidence
Gheist is a confirmed large-scale campaign abusing compromised GitHub identities to plant malicious Actions workflows across reachable repositories.
Provider-wide denominator and victim-organization mapping.
AI developer platforms, CI/CD, release pipelines and extension/package ecosystems are adjacent credential-acquisition surfaces; distinct incidents remain distinct identities absent shared evidence.
Shared upstream credential/publisher/build lineage or authoritative attribution.
Exact credential/account/workflow path allowing malicious builds into Cursor Marketplace is not publicly established.
Cursor RCA, marketplace audit/publisher logs and compromised-identity timeline.
No reliable public denominator separates install/update exposure, loader execution, persistence installation and successful remote SSH access.
Marketplace install telemetry plus endpoint execution/persistence/network/authentication evidence.
Public evidence does not quantify interactive sessions, credential/session abuse, lateral movement or identify the actor.
Victim IR, authentication/network logs, cloud/source-control audit logs and authoritative attribution.
POST_COMPROMISE_ACTIVITY_ATTRIBUTION