8 ms·
Code highlighting extension for Cursor AI used for $500k theft
- BigChemical 1y ago[dead]
- christophilus 1y agoSupply chain attacks really worry me. I do most of my work in docker containers partly as a small attempt to mitigate this. I run the full stack in the container, including Claude Code, Neovim, Postgres, etc. I do have a fair number of Neovim plugins on my host machine, and a number of Arch packages that I probably could do without. I’ve considered keeping my host’s Neovim vanilla, but telescope is hard to live without.
- aldur 1y agoSame worries and setup here, with the only difference that I use Nix to either spawn a QEMU VM or build an LXC container that runs on a Chromebook (through Crostini). I started using throwaway environments, one per project. I try keeping the stuff installed in the host OS to the bare minimum. For the things I need to run on the host, I try to heavily sandbox it (mostly through the opaque macOS sandbox) so that it cannot access the network and can only access a whitelist of directories. Sandboxing is painful and requires trial an error, so I wish there was a better (UX-wise) way to do that.
- bravesoul2 1y agoSupply chain attacks mean you need to trust your choice of suppliers, trust their security posture and choice of suppliers and so on. Even docker itself has FROM and often a few "apt get" (or similar) commands to build the image. Even with no file access, they can exfiltrate data. This and MCP, IoT all the things, vibe coding, AI impersonation for social attacks and cryptocurrency rewards it's a golden age for criminal hackers!
- throwawayffffas 1y agoNot just apt-get it might even have some `curl ... | sh`.
- chasd00 1y agoCurl | sh is gold. It’s like finding a candy bar on the street and eating it heh.
- dns_snek 1y agoYou can say the same about the vast majority of distribution methods we have. There's no difference between `curl | sh` and executing a binary you download from the internet.
- bravesoul2 1y agoChecksums and signatures make it slightly better. At least you can go from OK to vulnerable by downloading the same thing as an hour ago. But if you upgrade then yeah.
- fc417fc802 1y agoThe number of dependencies that require inordinate amounts of effort to build from a clean repository without network access is truly alarming. Even many core tools can't be bootstrapped (at least easily or in a manner supported by the developers) without downloading opaque binary blobs. It's like the entire software ecosystem is underpinned by sketchy characters hanging out in dark alleys who clandestinely slip you the required binaries if you ask nicely.
- xinayder 1y agoDo you use devcontainers or a custom-built solution? Would you mind sharing how you do your dev work using containers? I've been looking to try it out, and this attack might be the tipping point to where I actually do that.
- christophilus 1y agoCustom. I have a little script: “dev sh” which creates a new container for whatever folder I’m in. The container has full access to that folder, but nothing else. If there’s a .podman/env file, the script uses that to configure things like ports, etc. From what I saw of devcontainers, they basically grant access to your entire system (.ssh, etc). May be wrong. That’s my recollection, though.
- riv991 1y agoMicrosoft were very quick to highlight their extensions being safer after this. https://x.com/code/status/1943720372307665033?s=46 https://x.com/code/status/1943720372307665033?s=46
- delusional 1y agoPeople better remember that tweet the next time somebody finds another malicious extension on their marketplace.
- the_mitsuhiko 1y agoUnfortunately the marketplace ecosystem is why I went back to VSCode from Cursor. I'm a bit upset by this because I don't quite appreciate that Microsoft has a closed ecosystem for the marketplace and does not open it to Cursor but the reality is, that Open VSX does not have all extensions and little vetting.
- notpushkin 1y ago> Open VSX does not have all extensions This can be solved quite easily for open source extensions: https://github.com/EclipseFdn/open-vsx.org/wiki/Auto-Publishing-Extensions https://github.com/EclipseFdn/open-vsx.org/wiki/Auto-Publish... Vetting however is trickier. I hope Cursor can fund this effort!
- worble 1y agoAnd yet, this entire class of abuse is only possible because Microsoft refuse to implement any kind of permission management or sandboxing for extensions. https://github.com/microsoft/vscode/issues/52116 https://github.com/microsoft/vscode/issues/52116
- rs186 1y agoSecond this. As a vscode extension author, I am scared by the power I have. I am not at all surprised by what happened in this story.
- 1y ago
- notachatbot123 1y agoMuch less click-baity if a more descriptive title would have been used: "Malicious copy of Cursor AI extension used for $500k theft"
- samrus 1y agoThe title does make it sound like the AI itself lead to the vulnerability, which is false But cursor isnt off the hook. It wasnt a malicious copy, it was a legit copy of the cursor IDE distirbuting a package they allowed on the extension store. This is on them. The lesson here is to not make a vscode fork if you arent able to maintian it the way microsoft does. Move fast and break (the user's) things i guess
- worble 1y agoThe article says they use open-vsx, which is managed by the Eclipse foundation. It's not really anything to do with cursor, other than the fact they're allowing you access to the only other vscode marketplace that all the forks use.
- btown 1y agoThe biggest "reveal" here is that open-vsx has far less effective anti-fraud measures than the end users of Cursor, Windsurf, etc. expect. It seems that an attacker was able to easily manipulate download counts, placing their malicious extension high in search results. And this is far from the first open-vsx vulnerability in the past month. See: https://blog.koi.security/marketplace-takeover-how-we-couldve-taken-over-every-developer-using-a-vscode-fork-f0f8cf104d44 https://blog.koi.security/marketplace-takeover-how-we-couldv... which describes how open-vsx was installing arbitrary packages and running their build scripts in a privileged environment. And the instructions to report malicious extensions, even now, are practically nonexistent: https://github.com/EclipseFdn/open-vsx.org/wiki/Guidelines-on-Extension-Requests#questions-about-licenses-and-potentially-malicious-extensions https://github.com/EclipseFdn/open-vsx.org/wiki/Guidelines-o... With billions of dollars being poured into this ecosystem, it's mind-boggling that security is being treated as such an afterthought. Consider this when choosing tools.
- EDEdDNEdDYFaN 1y agoclickbait title it wasn't even a cursor specific extension it was a vscode one. completely misleading
- dcastm 1y agoSeems VSCode quickly removed this extension from their marketplace: https://x.com/code/status/1943720372307665033?s=46 https://x.com/code/status/1943720372307665033?s=46
- EZ-E 1y agoAm I understanding right the extension was free to download code from internet and execute with enough rights to scan the user's disk? That is wild. Does this mean every company is one bad extension install away from having its entire codebase stolen or worse? I naively assumed the extensions were 'sandboxed' to some degree.
- delusional 1y agoThese systems rely on downloading and executing much more untrusted software than you could ever imagine. Please dig deeper into this for yourself, I think that's the only way for anyone to truly appreciate the mess we are getting ourselves into.
- sshine 1y agoThere is no ACL system in place for VSCode extensions, no. Any extension has full access to execute programs as the user. Your operating system might have some security measures in place.
- bravesoul2 1y agoEven with just internet access an extension could upload your entire codebase. Git extensions for example need this level of access by design. How else could you set a different remote and push all refs:)
- pjc50 1y agoBrowser extensions are sandboxed. Editor extensions not at all.
- liveoneggs 1y agobut the editor is a browser!
- alternatex 1y agoAll the memory usage of a browser with the added benefit of less security :)
- joelthelion 1y agoSo that guy used the same machine for development and holding 500,000$ in cryptos?
- oc1 1y agoMost people do.
- joelthelion 1y agoMost people don't hold 500k in cryptos. Holding that much money on a machine that is not ultra secure is borderline insane.
- djrj477dhsnv 1y agoIf it's less than 1% of your net worth, not that insane. It's similar to how many crypto businesses will have a hot wallet with some fraction of their more secure cold wallet that they're okay losing.
- LikesPwsh 1y agoCryptocurrency contracts are going to touch actual tokens at some point. Even if the compromise wasn't on the developer's machine, it could have enabled a supply chain attack post-deployment.
- walls 1y agoThere are test networks, and anyone with more than $500 in crypto should be using a hardware wallet at this point.
- Jhsto 1y agoThought the same thing, could it be a false claim to get a nice headline thus clicks on your site?
- darkwater 1y agoYou know you are in a cycle when some new software/paradigm brings new solutions and approaches while it forgets about basic stuff already implemented for ages by prior solutions. It's basically like an adolescent. I guess this is how we evolve?
- lmz 1y agoIt's nice how they still respected copyright by not copying actual useful code out of the original extension.
- dcastm 1y agoHow do you stay safe from this kind of attacks?
- Velorivox 1y agoEasy: stay away from crypto.
- pshirshov 1y agoUse hardware wallets, avoid running Windows, hash-pin your extensions with Nix and carefully review them in advance.
- Asmod4n 1y agoThe System you keep your wallet on must be secured like a bank. Because the app can do nearly everything a bank can do (except refunds)
- const_cast 1y agoMultiple steps: 1. Be aware of remote code downloading and execution. VSC extensions are remote code. Try to find out if you trust the source. I trust Debian repos, I certainly do not trust the VSC marketplace. 2. Know the policies around sandboxing. VSC is not a browser, and does no sandboxing at all. 3. Containerize or virtualize the application. If you're on Linux, always use Flatpak. Deny all filesystem permissions except for your root source code directory. This goes for browsers, too. Ideally they should support xdg-download and then have zero file permissions at all - otherwise, only grant ~/Downloads. Don't want a zero-day stealing your files. 4. Keep sensitive data in a separate, encrypted place. On Linux, you can use KDE vaults. In a perfect world, we wouldn't be downloading and running remote code at all. But for practically, this is untenable. I have JS enabled in my browser. Our best bet is limiting the blast radius when things go south.
- ivanjermakov 1y agoDupe: https://news.ycombinator.com/item?id=44565994 https://news.ycombinator.com/item?id=44565994
- pshirshov 1y agoBut this is not about Cursor. It's a supply chain attack, and a Windows machine running a software wallet. A hardware wallet would make this impossible.
- bravesoul2 1y agoHardware wallet makes this less likely. Yes.
- TrackerFF 1y agoShould be trivial to search for links inside the code for the extensions. Though attackers can obfuscate those trivially too.
- voidUpdate 1y agoI'm surprised that you can still get .su (soviet union) domains. I'd have thought someone would have said that you can't buy them anymore
- poly2it 1y agoHow much are you missing out on if you just ban *.su connections on your device?
- voidUpdate 1y agoAccording to wikipedia, organisations with roots in the soviet union, the Donetsk People's Republic, white supremacist websites and cybercrime. So you can probably safely block it unless you're into those kinds of things. EDIT: also student's unions apparently, which kinda makes sense
- nubinetwork 1y agoRussia doesn't give a shit. https://en.wikipedia.org/wiki/.su https://en.wikipedia.org/wiki/.su
- nottorp 1y agoCan’t blame the LLM for once… clickbait title.
- vultour 1y ago> The developer was well aware of the cybersecurity risks associated with crypto transactions, so he was vigilant and carefully reviewed his every step while working online. Uses Cursor. Downloads random extensions.
- Gigachad 1y agoTbh it’s literally impossible to use your computer normally and be vigilant enough to protect crypto. No one could ever properly audit everything they run.
- dist-epoch 1y agoIt is possible. Brand new laptop, stock Ubuntu on it, nothing else. If you don't want to go the Qubes OS way.
- weird-eye-issue 1y agoYou interpreted "normally" in a very interesting way.
- throwawayffffas 1y agoUsing qubes os is a "normal" way to use a computer.
- djtango 1y agoIf you have more than high 5 figures of money lying around, should you be co-mingling it with your everyday activities? I wouldn't feel particularly comfortable even having 5 figures of tradfi cash lying around in my house let alone carrying it on my laptop where someone could steal my bag or machine and that's before it is connected
- tomrod 1y ago"Common" != "Normal".
- 1y ago
- OkPin 1y agoThis incident really underscores how AI-powered dev tools, which rely on open-source extension registries like Open VSX, can be weaponized via supply chain abuse. A $500k crypto heist via a bogus “syntax highlighter” signals a scary maturity in these attacks. Ranking manipulation, using recency and inflated download counts, to outrank the legitimate Solidity package is a clever exploit of how developers search. It makes me wonder: should IDEs start validating package authorship or offer signed extensions as a default? Also, the fact that this happened on a freshly imaged system with no antivirus suggests we need to rethink trust models for extension marketplaces. Not just for crypto devs, but for any industry sensitive to code integrity.
- oc1 1y agoWe're getting back to the old age of antivirus software. Can't wait to install Norton or Kaspersky on my Mac M5. Also good time to start your antivirus ai startup.
- OldfieldFund 1y agoCan you sell me your Mac M5, time traveller?
- ljf 1y ago(and it seems very likely the 'person' you are replying to is a bot/AI in this case too)
- braggerxyz 1y agoSome crypto bro got scammed while being involed in some AI shit? How ironic. Yet, the extension dilemma is also utterly shit. That's why I stay far away from "VSCode and friends"
- rubymamis 1y agoHow's the extension able to run powershell commands with no warnings or permission requests? I assume this is type of attack is not possible on macOS?
- rightbyte 1y agoWhy do we pretend executing malicious code is sandboxable? It is a social problem not a technical problem.
- rs186 1y agoThis is basically RCE that can happen on any OS.
- nubinetwork 1y agoMake it a bash script, and it'll run almost anywhere...
- rubymamis 1y agoOnce the equivalent of "ScreenConnect" is downloaded and run on macOS, I assume Gatekeeper will not let it run?
- oefrha 1y agoWrong, bash scripts can pop up a series of permission prompts on macOS if you do a full disk scan. They’re only suppressed when directly run from an application like Terminal that’s already been given full disk access or developer tools permission. In fact, sometimes the syscall just silently fails with no permission popup. For instance I have this python script calling an HTTP endpoint on LAN that when run within tmux would sometimes inexplicably fail with no route to host error because it doesn’t have local network scan permission, there’s no permission prompt, and the only solution is to restart the tmux server.
- notpushkin 1y ago> from an application like Terminal that’s already been given full disk access or developer tools permission Most likely that includes your IDE?
- arnaudsm 1y agoContext : Cursor, despite raising $900M, is a vscode fork that uses the open-vsx extension registry. It is maintained by european volunteers at a non-profit, and does not have the resources to check for supply-chain attacks like this. Freeloading on (and blaming) volunteer infrastructure is irresponsible, especially when you have so much funding.
- Cthulhu_ 1y agoCursor, Microsoft, and all the major players in this space should invest heavily in a managed dependency / plugin service, also for the huge amount of nodeJS package. They need a review, scan, certification and warranty program. Apple did it 15 years ago, time for the rest to catch up. They can turn it into a business by offering enterprise subscriptions for higher guarantees or a warranty.
- arnaudsm 1y agoMicrosoft claims their team banned the extension in "2 seconds" https://x.com/code/status/1943720372307665033?s=46 https://x.com/code/status/1943720372307665033?s=46 Concerning Apple, their review process is so hard and unjust, I've seen startups give up apps after months of work just because of that. Maybe sandboxing and runtime-level permissions are a better compromise?
- blibble 1y agothe entire AI industry is based on mass parasitism of art, music, articles, newspapers, books and open source code why would they start investing now when they can just continue to plunder the commons uninterrupted?
- spwa4 1y agoThat's the more general issue, isn't it? Users demand software, guarantees, ... and refuse to pay for it. That goes for the AI industry itself, but equally for everyone using it. Microsoft won when it found a way to extract software fees as a tax from hardware manufacturers. FANG won when it found a way to extract software writing and hosting fees from advertisers, effectively making it a tax on everything you buy. Both of these (Operating systems and basic cloud services like email hosting) can be done for a lot cheaper if they were paid for by end users, but those just won't pay. In fact, for a while they were paid by end users (microsoft did that, gmx.net, infomaniak, ...). Then everyone switched to "free" and here we are. And we all know there's no way back, so what's the point discussing it? We all know most people will just not have email or web search if they had to pay even 5$ per year to get it, and I seem to recall an article stating Google effectively earns over $100 per year per account. Reality is: give it another 2 years and the "art, music, articles, newspapers, books and open source code" industries will reach absolutely nobody except through AI providers. That could be avoided if every creator paid $1 per year to have free infrastructure for their services, but there's no way in hell they will do that ... so here we are. In 2 years instead they'll pay $1000 every time they want someone to actually look at their art. And yet, the situation with banking services is far worse, imho. So bad, in fact, that even charging $0.01 per year for internet services would be a nonstarter.
- mrkramer 1y agoI'm always anxious when I download npm packages or when I pip Python packages...tbh it's a gamble because there are so many supply chain attacks and/or malicious developers.
- samsk 1y agoThats why I always develop on a per customer mini VM via VSCode ssh remoting or similar, and projects are usually runned via docker-compose or devcontainers.
- meander_water 1y agoThere's actually a new setting in vscode (from Dec 24) to configure a whitelist for extensions that are allowed to be installed on a user's machine [0]. It's not foolproof, but it probably helps to prevent common supply chain attacks. I wonder if this could be used in cursor too. [0] https://code.visualstudio.com/docs/setup/enterprise#_configure-allowed-extensions https://code.visualstudio.com/docs/setup/enterprise#_configu...
- benhurmarcel 1y agoI dread the day our IT department gets their hands on that
- throw7484485 1y agoDownloading random code from internet is just normal development on Mac. Brew, npm and other sorts of "package managers". I have code, passwords and certificates separated in virtual machines, even IDE GUI app is virtualized, and has no rights to access GitHub, internet or filesystem directly. But I get a lot of flack from coworkers. They say it is unintuitive and uses x86 CPU which is uncool. Mac has no reasonable VM software or secure containers!
- OldfieldFund 1y agoMac has also much fewer Trojans/Stealers than Windows as far as I understand.
- throw7484485 1y agoBut I am not on windows
- signaleleven 1y agoSomewhat humorously, my company displayed an IT warning telling me that I can't visit the website in question because it's in Russia. I probably set off some kind of alarm somewhere. I do use Cursor at work and I have various extensions installed.
- londons_explore 1y agoIf you want to know if you've fallen victim to such an attack, this might help: https://serverthiefbait.com https://serverthiefbait.com It is a small crypto wallet you can hide in your computer and be notified when someone steals from it.
- il-b 1y agoValuable wallets should only be accessed from designated devices with no unrelated software installed on them.
- Kate5477 1y ago[dead]