News / Industry
Malicious Extensions Turn Cursor and Windsurf Into Supply Chain Targets
Malicious extensions are reaching Cursor, Windsurf and other VS Code forks through Open VSX, planting backdoors and stealing SSH keys and source code.
AI code editors have turned their extension marketplaces into a live software supply chain target. On October 29, 2026, a tampered copy of Anthropic's Claude Code extension sat in Cursor's marketplace for about 11 hours, and the malicious build tried to plant an SSH backdoor on machines that installed it. Cursor estimates up to 5,000 developers may have installed the poisoned version before it was removed and the marketplace was taken offline. No click was required: loading the extension was enough to run the code.
| Key fact | Detail |
|---|---|
| Affected tools | Cursor, Windsurf and other VS Code forks, including Google Antigravity and Trae |
| Registry | Open VSX, the open marketplace these forks use in place of Microsoft's, plus the forks' own marketplaces |
| Attack types | Name-squatting on unclaimed namespaces, evil-twin lookalikes, tampered copies, payloads that auto-execute on load |
| Impact | SSH keys, cloud credentials, source code, CI metadata, persistent backdoors |
| Notable incidents | Tampered Claude Code extension on Cursor (Oct 2026), 77 counterfeit Open VSX extensions (Aug 2026), $500,000 crypto theft via fake Solidity extension (2025) |
| Mitigations | Pin publishers and exact versions, verify on Open VSX directly, least privilege, secret hygiene |
What happened
The Claude Code case is the clearest example so far, and it comes with an important caveat. Anthropic's Claude Code is a legitimate AI developer tool, and the flaw was not in it. An attacker used access to Cursor's marketplace to publish a tampered copy, versions 2.1.312 and 2.1.313 for macOS and Windows, with malicious JavaScript prepended to the extension's main file, according to Cursor's security notice. Early coverage pointed at Open VSX, but Cursor and Anthropic later confirmed the bad builds lived only in Cursor's own marketplace, and that version 2.1.313 was never published to Open VSX or Microsoft's marketplace, per StepSecurity.
What made it dangerous is how editor extensions run. The payload executed the moment the extension loaded, with no user interaction and no Claude session involved. It added an attacker controlled SSH key labeled svc-telemetry to the authorized_keys file, tried to switch on the local SSH service, and opened a reverse tunnel to a server at 134.209.82.225, retrying about once a minute and persisting through a macOS LaunchAgent or a Windows scheduled task, StepSecurity found. Researchers whose analysis BleepingComputer cited noted that coding errors likely kept SSH from turning on across many hosts, and that the script did not read credential values directly. It still gathered reconnaissance, including the names of environment variables matching patterns such as KEY, TOKEN, SECRET, AWS and GCP, BleepingComputer reported. The underlying weakness is not unique to Open VSX. Security researcher Mazin Ahmed showed a deliberately misspelled Python linter clearing Microsoft's own marketplace screening and then running its payload at editor startup, a risk Microsoft reportedly rated low severity, per CyberPress.
The incident fits a wider pattern. Because Cursor, Windsurf, Google Antigravity and Trae are VS Code forks that cannot use Microsoft's marketplace for licensing reasons, they pull extensions from Open VSX, an open registry that does less pre-publication vetting. In January 2026, Koi Security showed that these editors inherit VS Code's hardcoded list of recommended extensions, which points at Microsoft's marketplace, and that some of those extensions have no Open VSX entry, so their publisher namespaces sit unclaimed and open for anyone to register, BleepingComputer reported. Koi claimed six such namespaces with harmless placeholders before an attacker could. Cursor closed the gap on December 1, 2025, and Google removed 13 recommendations soon after. Windsurf had not responded at the time.
Name-squatting like this needs no phishing. A VS Code extension runs with the developer's own privileges and can execute on load, so a convincing lookalike in an unclaimed namespace is a straight line to SSH keys, cloud credentials and source code. Open VSX has already seen counterfeits at scale: in August 2026, Manifold Security found 77 fake extensions published over six days that reused the names of real tools, impersonating vendors from AMD to Salesforce and the Visual Studio marketplace itself, with 19 of them harvesting repository and CI metadata such as private GitHub names, all sent to a single domain registered 11 days earlier, per Infosecurity Magazine. A year before, Kaspersky traced the theft of about $500,000 in cryptocurrency to a counterfeit Solidity extension a developer installed in Cursor from Open VSX, which pulled in remote access software and a backdoor and lifted the victim's wallet seed phrases, Kaspersky reported. The same editors have been hit through adjacent channels too: Socket flagged three npm packages posing as Cursor tools that quietly patched the app to run attacker code, SecurityWeek reported.
Why it matters
The developer endpoint has quietly become one of the softest targets in the software supply chain. It holds source code, SSH keys, cloud tokens and CI access, and it runs a steady stream of third-party extensions that most teams never review. The move to AI-assisted coding widens that surface. The forked editors behind the AI coding boom depend on a registry with lighter vetting, and they ship with recommendation and install flows that can route developers to the wrong listing. This is the gap between attack surface and attack path: one poisoned extension is both an exposure and a ready made path from a laptop to production code. It also lands at a moment when attackers are already using AI to build and spread payloads, and when AI agents are running real intrusions.
Your code editor installs software that runs with your privileges, which makes its marketplace part of your attack surface, not a convenience you can wave through.
The Threatless read
Developer tooling is attack surface. The editor, its extensions and the registry behind them sit upstream of almost everything a team ships, and they are now being targeted on purpose. The next steps are not exotic. Inventory what runs inside your editors, pin known publishers and versions, drop what you do not need, and assume that any extension that loaded while a secret was in reach is a reason to rotate that secret.
This is the premise behind how we build at Threatless, and why we build it to be AI-native. Threatless Surface works to keep an accurate, current view of exposures like these across an organization, and Threatless CTEM is built to prioritize the ones that open a real path to what matters, so teams fix what an attacker would actually reach first. Developer endpoints and the software supply chain belong inside that exposure management picture, not outside it. The editors are not going anywhere, and neither is the incentive to poison them, so the registries and the endpoints that rely on them deserve the same scrutiny as any other part of the attack surface.