GoPlus Security 🚦 (@GoPlusSecurity)

⚠️ Cursor has published a security incident report on the earlier supply chain attack. According to the investigation, the attacker used access keys issued by Cursor to Fireworks and subsequently exposed on Fireworks’ side to gain access to some of Cursor’s SaaS services and internal systems. The attacker ultimately tampered with the distribution cache for the Claude Code extension to collect information about users’ machines and install SSH backdoors. The compromised versions were Anthropic.claude-code 2.1.312 and 2.1.313 in Cursor’s VS Code extension marketplace distribution cache, affecting macOS and Windows. The exposure window ran from October 29 at 17:27 to October 30 at 04:35 (UTC+8), with up to approximately 5,000 users affected. Security recommendation: If you installed or updated to either affected version through Cursor’s marketplace during this window, read the official notice as soon as possible and run the remediation script for your platform to check for and remediate any compromise: Fireworks’ initial announcement and subsequent update: