Hacker News Reader

Comment by xx_ns | Hacker News Reader

I think it should be important to note that this affected the Claude Code extension on the Open VSX extension registry (and by extension, the Cursor marketplace). From what is currently known, the build on the official marketplace was/is clean.

EDIT: I am now actually unsure if this is the case. From what I can see, all of the write-ups mention the Cursor marketplace and Open VSX specifically, but make no explicit mention of the official Microsoft registry.

EDIT 2: The version that was compromised (2.1.313) seems to have never been published on the official Microsoft registry. As per the documentation [1], unpublished versions should still be discoverable:

> When you unpublish an extension, the Marketplace preserves the extension statistics. The extension remains publicly discoverable and available via an existing API.

[1]: https://code.visualstudio.com/api/working-with-extensions/pu...

View on HN

Dworken from Anthropic here: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.

Thanks for clarifying!

Hi Dworken from Anthropic, how is that possible if Cursor uses OpenVSX?

It seems like they put a proxy in front of OpenVSX: https://cursor.com/help/customization/extensions

However, statements around the internet (and in these comments) are less than definitive as to whether a) that proxy has a cache that was compromised; b) that proxy has select extensions which can be published directly to it by hand (one of which was compromised); c) other.

It's really not acceptable that Cursor is less than crystal clear on details such as this...

Thanks! I would believe it more it if you shared your system prompt so I can make sure its really you.

You mean on the Microsoft VSCode marketplace? The version has been yanked from there as well, but that could just be a precaution and to avoid confusion about having the same version be simultaneously infected and not infected.

This very much illustrates the danger of just carelessly installing untrusted software on your machine. In this case it happens to be code from Anthropic, but it could have been almost anyone. I'll be very interested in see the explanation from Anthropic, because of all the extension developers they should have the best tools for finding issues like this. LLMs have proven pretty good at finding security issues, so did they simply not let their own AI tools vet the code before shipping it? Or was the extension infected later, because in that case every single extension on Open VSX could be at risk.

What would be the careful way of installing the official extension?

That is a really good question, because you almost can't do it. You could download the extension, diff it against the previous version and read all the code. Expecting people to do that it just a bit much. At some point we have to trust someone and in this case it will be interesting to see if it's the marketplace or Anthropic we couldn't trust.

> You could download the extension, diff it against the previous version and read all the code.

This would actually be an exceptionally good use-case for AI. You don't need a super-duper frontier model to download a bit of source-available code and check for suspicious signs, any cheap model would do well enough. Heck, it's effectively virus scanning, we've had that for decades.

The CTA flavor of the year for dev tools is cURLing some arbitrary install script and run it immediately which always sounded ridiculous to me. If instead that script first pipes into claude -p for a basic vulnerability scan before continuing, I would be delighted.

Hopefully a well-sandboxed claude -p.

LLM are not designed for that. Unless prompt injection is really solved I would avoid showing LLM untrusted code.

Cursor explicitly claims "Before an extension is shown in search or served as a download, Cursor runs automated malware and supply-chain analysis using commercial security tooling. Extensions that fail review are blocked. Cursor also monitors extension-ecosystem threat intelligence and updates its blocklist over time."

However, the bad extension was live for ~11 hours.

That's a testament to the strength of their so called "commercial quality" security tooling.

Norton Anti Virus...

I recommend moving to VSCodium and using this extension:

https://github.com/jeanp413/open-remote-ssh

and run vscode-server inside a VM or container

Would that really help, if you install the extension it's running in the VSCodium instance on your machine... or is it running in the vscode-server?

Most extensions run in vscodium-server, extensions run either as "Local Extensions" that run on the host and "Remote Extensions" that run on the guest. You can clearly see in the UI which ones run where.

I only have a single "Local Extension" and it is open-remote-ssh itself.

Of course anything you put into the container can be compromised, like git ssh keys or cloud provider keys/auth-tokens. But at least it keeps your PC from becoming a botnet and your browser credentials out of reach. If you have a Containerfile/Dockerfile with everything you need you can quickly wipe everything and re-create your dev environment from scratch (which I do every once in a while), wiping any malware you might have gotten in there.

When running inside a container you can do some nifty things like keeping root directories immutable. I have been meaning to make some user directories immutable in my container but just been too lazy to do it.

You disable extension auto updates and then manually install every so often (and only update/install when the version has been out for 3+ days).

The screenshot is of the official marketplace

Do you have any sources? OP claims that it *also* affects Open VSX

Three different marketplaces have been mentioned in this discussion:

1. The Cursor Marketplace (never heard of this one, it’s possibly a custom marketplace hard-wired into Cursor, which is architecturally a VS Code fork?)

2. The Visual Studio marketplace, hard-wired into VS Code

3. Open VSX

If I understand this thread correctly, then #1 and #3 had compromised versions, and nobody has made a statement yet about the status of #2.

Cursor maintains a mirror of OpenVSX... Kinda. Except they inject some of their own extensions in it. But it's mostly a mirror.

Edit: Cursor is apparently stating now that the tampered files were only on their mirror not OpenVSX.

I assumed they meant "also" as in "besides Cursor marketplace", which seems to be the highlight of the article. Although you raise a valid point and I've edited the parent comment.

But the report OP cites at https://phorion.io/blog/offical-claude-code-vsx-compromise/ doesn't make a claim about Visual Studio Marketplace, only "the official Claude Code for VS Code extension bundle on the Cursor Marketplace"

Reply on news.ycombinator.com