A Malicious VS Code Extension: How Do You Know You’re Affected?

Rakesh Kadam

2 min read

·

1 day ago

--

Listen

Share

Lessons from the October 2026 Cursor–Claude Code security incident.

On October 29, 2026, Cursor reported a supply-chain security incident involving the Anthropic.claude-code extension.

Two versions, 2.1.312 and 2.1.313, distributed through the Cursor Extension Marketplace, were identified as malicious.

The payload could establish unauthorized SSH access and persistence on developer machines.

But investigating the incident raised an interesting question:

If your security inventory detects one of these versions, does that mean the device is compromised?

Not necessarily.

1. Start With Extension Discovery

First, identify which developers have the extension installed.

For VS Code:

code --list-extensions --show-versions \
  | grep -i anthropic.claude-code

For Cursor:

cursor --list-extensions --show-versions \
  | grep -i anthropic.claude-code

At enterprise scale, tools such as Intune, EDR platforms, or software inventory systems can help identify potentially affected endpoints.

2. The Challenge: Where Did It Come From?

The incident concerned a specific distribution channel: Cursor’s marketplace.

Finding the same extension ID and version in an inventory doesn’t automatically establish where the package originated.

We need to validate:

• Version: Is it one of the affected versions?
• Source: Was it downloaded from the compromised marketplace?
• Timeline: Was it installed or updated during the affected window?
• Integrity: Does it match a known-malicious artifact?

Inspect local extension metadata, editor logs, installation history, and package hashes where available.

A PURL or package inventory entry alone might not establish marketplace provenance.

3. Check for Indicators of Compromise

According to Cursor’s advisory, the malicious payload attempted to establish SSH-based access and persistence.

On macOS, two useful checks are:

grep 'svc-telemetry' ~/.ssh/authorized_keys

ls ~/Library/LaunchAgents/com.apple.sysmond.plist

These checks are not exhaustive. A clean result does not rule out compromise.

Security teams should correlate vendor-published indicators with endpoint telemetry and investigate any suspicious findings.

4. Practical Containment and Recovery

If an endpoint may have installed the malicious extension, follow a structured incident-response process.

Contain the endpoint

• Isolate the device using EDR or endpoint management when exposure is credible.
• Preserve relevant logs, extension files, and forensic evidence.
• Block known malicious infrastructure using verified vendor indicators.

Remove the threat

• Uninstall the affected extension and remove confirmed malicious persistence mechanisms.
• Review SSH authorized_keys for unauthorized entries.
• Investigate suspicious processes, scheduled tasks, and outbound connections.

Recover securely

• Rotate potentially exposed SSH keys, GitHub tokens, cloud credentials, and other developer secrets from a trusted device.
• Rebuild or reimage the endpoint if compromise is confirmed or cannot be confidently ruled out.
• Reinstall extensions only from verified sources.
• Validate endpoint health and monitor for recurring malicious activity before reconnecting the device.

Important: Simply uninstalling the extension may not remove persistence or invalidate stolen credentials.

5. The Real Lesson

Traditional vulnerability scanning focuses on:

Package + Version

Supply-chain incident response needs more:

Package + Version + Source + Timeline + Integrity

Finding a vulnerable extension is only the first step. Establishing whether the malicious artifact reached and executed on an endpoint requires additional evidence.

Security inventory tells you what might be affected. Forensics helps establish what actually happened.

Reference: Cursor Security Advisory

#DevSecOps #CyberSecurity #SupplyChainSecurity #IncidentResponse #VSCode #Cursor