undefined

points

[-]

Cursor uses OpenVSX marketplace (https://open-vsx.org/), that all non-Microsoft forks of VSCode utilize (official marketplace is only allowed in official proprietary VSCode release). It's not really related to Cursor/SpaceX in any way.

I suspect it's still Anthropic who were hacked, because they control OpenVSX account with release privileges.

edit:

Binance confirms my suspicions, via https://www.binance.com/en/square/post/10-30-2026-claude-cod...

  The affected Open VSX extension is owned by Anthropic employee Igor Kofman, but it is unclear whether his account or another part of the publishing process was compromised.

by AdrianCX1 days ago|

parent|

[-]

Just did a quick search, OpenVSX has no extension signing?, no verifications?, what year is this...

This could have been avoided by having extensions signed by company doing them with keys and review

by darkwi11ow1 days ago|

parent|

[-]

Yeah OpenVSX security is a joke, they also have dumb search algorithm which allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim their proprietary VSCode marketplace to be more secure.

by tyingq23 hours ago|

parent|

[-]

Vscode(ium) extensions are also pretty weak security wise in general. There's little guardrails on what an extension can do.

On publishing, I do see that the MS marketplace has much better typosquatting and rogue publisher protection. It's unclear to me how much better their SAST/scanning is than OpenVSX. Both have something, but both have been fooled many times, and recently.

by AdrianCX1 days ago|

parent|

prev|

[-]

Then why even allow employees to use that?

Binance got a pretty expensive lesson if that was the cause for their recent hack

by darkwi11ow1 days ago|

parent|

[-]

There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no good alternative to it. Google tries to compete via Antigravity, but that also uses OpenVSX. I myself use Cursor and use Claude there installed via OpenVSX, and was not affected only thanks to my laziness (I saw upgrade button, but became distracted and did not click). I hope this situation will become a trigger to improve OpenVSX security.

by AdrianCX1 days ago|

parent|

[-]

Why not use claude code directly?

Why risk getting compromised like that?

by darkwi11ow23 hours ago|

parent|

[-]

Well for me, as developer on a modern stack, there is always some risk involved. If not from agentic tools, then the package registries are compromised left and right, so it all comes down to mitigating the risk. I use Claude, Codex and Cursor/SpaceX agents, and Cursor comes very convenient to have all three in a single interface. Also I still code manually especially when prototyping, so having an IDE helps with it as well. I knew about OpenVSX situation with the search, so when installing extensions I always did triple-checking to verify the extension being really submitted by upstream and not by squatter; but now given upgrades can also deliver a compromise I am thinking of developing an extension that will act in similar manner to pnpm minimum release age.

by darkwi11ow18 hours ago|

parent|

[-]

To anyone who might be reading this exchange, actually there is recently added builtin setting for delayed auto-update, `extensions.autoUpdateDelay`, see https://github.com/microsoft/vscode/issues/316867 and https://github.com/microsoft/vscode/pull/321039

by Lazare23 hours ago|

parent|

prev|

[-]

Cursor has their own mirror of OpenVSX. Some reporting suggests the tampered files were on the Cursor mirror but not the main OpenVSX. (This is shown, among other things, by the Anysphere plugins available in the Cursor mirror but not in OpenVSX.)

Edit: It seems Cursor is claiming the tampered files were only in their mirror.

by cautiouscat20 hours ago|

parent|

prev|

[-]

A lot of this is turning into “well other company said” but Anthropic claims OpenVSX is fine?[1] And that Cursor has their own market place. I’m confused.

> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.

1: https://news.ycombinator.com/item?id=50304585

by tyingq1 days ago|

parent|

prev|

[-]

Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.

by axus22 hours ago|

parent|

[-]

Now I'm glad I've not opened VSCodium in a few weeks; I prefer using Claude as a separate application anyways, will have to remove the extensions. No evidence, but I do feel like the problem is going to be OpenVSX and not Anthropic.

by tyingq17 hours ago|

parent|

[-]

OpenVSX does have an option to use OIDC instead of a long lived token for publishing. I get the feeling a lot of people use the forever-good-unless-revoked token though.

https://github.com/eclipse-openvsx/openvsx/wiki/Trusted-Publ...

Edit: Ah, guess it was not open-vsx, but a in-house Cursor marketplace. https://news.ycombinator.com/item?id=50304129

by 1 days ago|

parent|

prev|

[-]

deleted

by philipwhiuk20 hours ago|

parent|

prev|

[-]

You're ignoring the "or" which is doing a lot of work.

Anthropic's position is seemingly that it was "another part of the publishing process [that] was compromised"

by no-name-here21 hours ago|

parent|

prev|

[-]

[flagged]

by albert_e23 hours ago|

parent|

prev|

[-]

The hacks and vluns are blending into a blur for me now -- why is Binance confirming Anthropic compromise while they have their own $6 Billion compromise to look at /s

Vibecoders are safu

by darkwi11ow23 hours ago|

parent|

[-]

Boris: "By winter 2025, 100 percent of my code was written by Claude Code. Not a single line by hand."

Igor Kofman: "I do not write any code by myself anymore."

Turns out if you are not writing the code, then North Koreans might do it for you

by K0nserv1 days ago|

prev|

[-]

Version 2.1.313 is also missing from the official VS Code marketplace (https://marketplace.visualstudio.com/items?itemName=anthropi...). This suggest to me that it was published and pulled, which means it was Antrophic that was hacked.

Version 2.1.313 is missing from the official Claude Code GitHub repo's CHANGELOG[0]. There's also no tag[1] for 2.1.313[1], but 2.1.312[2], and 2.1.314[3] exist.

0: https://github.com/anthropics/claude-code/blob/main/CHANGELO...

1: https://github.com/anthropics/claude-code/releases/tag/v2.1....

2: https://github.com/anthropics/claude-code/releases/tag/v2.1....

3: https://github.com/anthropics/claude-code/releases/tag/v2.1....

by no-name-here1 days ago|

parent|

[-]

You’re likely right, but they also might’ve just pulled the version (number) everywhere to make it ‘clearer’ or out of ‘caution’.

Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?

by K0nserv23 hours ago|

parent|

[-]

You make a good point, my comment above probably overstates things.

by mirashii23 hours ago|

parent|

prev|

[-]

There are regularly gaps in the claude code versions, e.g. if you go back a page, there's no 2.1.297, 2.1.298.

Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.

Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...

by sunaookami23 hours ago|

parent|

[-]

>Also, all their tags are immutable, and so can't just be deleted to hide things

Yes they can, they can remove the release and then remove the tag.

>If you delete the immutable release, you can delete the tag, but you cannot reuse the same tag name.

by mirashii23 hours ago|

parent|

[-]

You’re right, I read too quickly.

by sunaookami23 hours ago|

parent|

[-]

No worries, it's very unexpected. I just remembered because I did the same thing last week and was surprised it worked.

by XCSme22 hours ago|

prev|

[-]

I am starting to have a hard time who is responsible for what. I no longer know what's the relationship between companies/products like Anthropic, Cursor, SpaceXAI, Copilot, etc.

by Rapzid7 hours ago|

parent|

[-]

Nobody seems to be taking responsibility yet for what exactly was compromised, how, and what steps are being taken to prevent it.

It was 100% an "official" Anthropic extension. They say their systems were not compromised which, if true, suggests a bug or credential leak on the Cursor side. Cursor conspicuously left these details out of their public notice.