upvote

points

by viraptor22 hours ago |
comments
upvoteby eviks21 hours ago|
next
[-]
Why wouldn't their review system see a published extension and determine the very second it's published that it didn't match the results of a standard workflow?
reply
upvoteby crooked-v15 hours ago|
parent|
next
[-]
Because it wasn't published by them or hosted on a system they control, it was done directly on Cursor's mirror of OpenVSX with a modified copy of the original extension.
reply
upvoteby 17 hours ago|
parent|
prev|
[-]
deleted
reply
upvoteby cryptonym21 hours ago|
prev|
next
[-]
> someone got the credentials

> No review system at anthropic has seen this

Weird flex

reply
upvoteby viraptor21 hours ago|
parent|
[-]
I'm not sure where you see the flex. If someone gets hold of the token allowing the upload of your app to the store, it's completely irrelevant how good your internal code/review systems are. They've been completely bypassed and never triggered.
reply
upvoteby cryptonym21 hours ago|
parent|
next
[-]
Arguably, your security shouldn't stop at internal code review and should aim at protecting key distribution platforms credentials and assets that are pushed to your users.
reply
upvoteby viraptor21 hours ago|
parent|
next
[-]
Yeah, it shouldn't. But at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly. We know it isn't and it's not at that level, because anthropic employs engineers.
reply
upvoteby cryptonym21 hours ago|
parent|
prev|
[-]
> at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly.

Would be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future. We don't have any RCA, maybe there is little to nothing to blame them.

Not sure they'd share your views on using Claude for security policy/coverage being silly.

reply
upvoteby unshavedyak21 hours ago|
parent|
prev|
[-]
As an aside, it would be neat if publishing services like this had a sort of 2FA, eg the package manager had a hook endpoint where it sent the details of the next requested published version. Allowing the owners to validate.

Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.

reply
upvoteby InsidiousWombat21 hours ago|
prev|
next
[-]
It's legitimate question, it's the promise they are selling and doing IPO based off those promises.

Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious

reply
upvoteby paxy21 hours ago|
parent|
[-]
Who is "they"? This is a third party registry.
reply
upvoteby jacquesm21 hours ago|
prev|
[-]
Intelligence that powerful and for them too cheap to meter and their review system couldn't be bothered.

That wasn't a cheap troll. What they distribute and what Claude Code installs is on them. You're supposed to keep your channels clean and secure.

At a minimum they should monitor the larger marketplaces even if they're not in the chain.

reply