You Trusted the Marketplace. That Was the Point.

Nobody got tricked into anything 

That’s what makes this worth talking about. There was no dodgy email, no sketchy download, no user doing something daft they’ll feel embarrassed about later. People went to the marketplace they use every day, saw the extension they expected with the name they trusted, and installed it, exactly as they’re meant to. The trust was the whole attack. The marketplace is treated like an app store, you assume what’s in it has been vetted and is what it says it is, and that assumption is precisely what got used against everyone who installed it. 

We spend a lot of time telling people to be wary of what arrives in their inbox and almost no time thinking about what arrives through the channels they already trust. But a developer pulling an extension from a marketplace is making a trust decision just as much as someone clicking a link, they’ve just been taught to think of one as risky and the other as routine. 

It mostly failed, and that’s not comforting 

Here’s the honest bit. For most people, the worst of it didn’t actually land. Turning on SSH needs admin rights the extension didn’t have on a normal machine, so on most hosts the full backdoor never came up, and the attacker couldn’t have logged in through it. We got a bit lucky, in that the thing had bugs. 

I don’t find that especially reassuring, and I wouldn’t want a board to either. “The malware didn’t work properly this time” isn’t a control you can rely on. The next one won’t necessarily fumble the same step, and even this one still added the attacker’s key, installed its persistence and sent host details away before anyone knew. Building your sense of safety on the attacker making a mistake is not a plan. 

Uninstalling it isn’t cleaning it up 

The other part worth flagging, because it catches people out, is that pulling the extension doesn’t fix it. The payload drops its own standalone persistence scripts that keep running on their own, they don’t care whether the extension that planted them is still there. So the instinct, “I removed the bad thing, I’m fine now”, is wrong here, which is the same trap I keep seeing in actual incidents. The thing you removed and the thing still running are not the same thing, and “are we clean?” is a different, harder question than “did we uninstall it?”. 

Cursor have published how to check and a script to remediate properly, and if anyone installed that version in the window on the 29th October, running the uninstall and assuming that’s that is the mistake to avoid. 

What I’d take from it 

Anthropic didn’t ship this, to be clear, their tool was impersonated, and Cursor caught it and moved quickly. The useful lesson isn’t about any one vendor, it’s about where we place our trust. The marketplaces and extension stores our developers pull from every day are a delivery route straight onto the machine that holds the code, the keys and the cloud access, and we treat them as inherently safe in a way we’d never treat an email attachment. 

So it’s worth asking the plain questions before it matters. Do you know what your developers are pulling from these marketplaces, and from where? Would you spot a bad version going in? And if one did, is “uninstall it” really where your response ends, or would you actually go and check the machine was clean? None of that is dramatic, it’s just taking a trusted channel as seriously as we already take the untrusted ones.