Code highlighting extension for Cursor AI used for $500k theft

https://securelist.com/open-source-package-for-cursor-ai-turned-into-a-crypto-heist/116908/

by Daviey • 1 year ago

182 155 1 year ago

Supply chain attacks really worry me. I do most of my work in docker containers partly as a small attempt to mitigate this. I run the full stack in the container, including Claude Code, Neovim, Postgres, etc.

I do have a fair number of Neovim plugins on my host machine, and a number of Arch packages that I probably could do without.

I’ve considered keeping my host’s Neovim vanilla, but telescope is hard to live without.

aldur• 1 year ago

Same worries and setup here, with the only difference that I use Nix to either spawn a QEMU VM or build an LXC container that runs on a Chromebook (through Crostini).

I started using throwaway environments, one per project. I try keeping the stuff installed in the host OS to the bare minimum.

For the things I need to run on the host, I try to heavily sandbox it (mostly through the opaque macOS sandbox) so that it cannot access the network and can only access a whitelist of directories. Sandboxing is painful and requires trial an error, so I wish there was a better (UX-wise) way to do that.

bravesoul24• 1 year ago

Supply chain attacks mean you need to trust your choice of suppliers, trust their security posture and choice of suppliers and so on. Even docker itself has FROM and often a few "apt get" (or similar) commands to build the image. Even with no file access, they can exfiltrate data.

This and MCP, IoT all the things, vibe coding, AI impersonation for social attacks and cryptocurrency rewards it's a golden age for criminal hackers!

throwawayffffas4• 1 year ago

Not just apt-get it might even have some `curl ... | sh`.

fc417fc802• 1 year ago

The number of dependencies that require inordinate amounts of effort to build from a clean repository without network access is truly alarming. Even many core tools can't be bootstrapped (at least easily or in a manner supported by the developers) without downloading opaque binary blobs. It's like the entire software ecosystem is underpinned by sketchy characters hanging out in dark alleys who clandestinely slip you the required binaries if you ask nicely.

xinayder3• 1 year ago

Do you use devcontainers or a custom-built solution? Would you mind sharing how you do your dev work using containers? I've been looking to try it out, and this attack might be the tipping point to where I actually do that.

christophilus2• 1 year ago

Custom. I have a little script: “dev sh” which creates a new container for whatever folder I’m in. The container has full access to that folder, but nothing else. If there’s a .podman/env file, the script uses that to configure things like ports, etc.

From what I saw of devcontainers, they basically grant access to your entire system (.ssh, etc). May be wrong. That’s my recollection, though.

riv991• 1 year ago

Microsoft were very quick to highlight their extensions being safer after this.

https://x.com/code/status/1943720372307665033?s=46

the_mitsuhiko• 1 year ago

Unfortunately the marketplace ecosystem is why I went back to VSCode from Cursor. I'm a bit upset by this because I don't quite appreciate that Microsoft has a closed ecosystem for the marketplace and does not open it to Cursor but the reality is, that Open VSX does not have all extensions and little vetting.

notpushkin5• 1 year ago

Open VSX does not have all extensions

This can be solved quite easily for open source extensions: https://github.com/EclipseFdn/open-vsx.org/wiki/Auto-Publish...

Vetting however is trickier. I hope Cursor can fund this effort!

worble2• 1 year ago

And yet, this entire class of abuse is only possible because Microsoft refuse to implement any kind of permission management or sandboxing for extensions.

https://github.com/microsoft/vscode/issues/52116

rs1862• 1 year ago

Second this.

As a vscode extension author, I am scared by the power I have. I am not at all surprised by what happened in this story.

delusional2• 1 year ago

People better remember that tweet the next time somebody finds another malicious extension on their marketplace.

Quarrel• 1 year ago

and yet, there are many malware extensions per day that get through:

https://github.com/microsoft/vsmarketplace/blob/main/Removed...

jowea2• 1 year ago

2 seconds? That wasn't the team then, it must have failed some automated filter.

bootsmann• 1 year ago

Yeah it had a copy-paste description from the original extension, probably very easy thing to detect

nkrisc• 1 year ago

If the team put those filters in place, then it was the team. Anyone implementing automation gets to be held responsible for its failure, but also its successes.

IshKebab2• 1 year ago

Well this was an extremely unsophisticated attack. The malware wasn't hidden and they didn't even bother to actually copy the real extension.

If I were doing this I would copy the real extension, give it a name that made it sound official but in the README say it is a tweaked version with some improvements or whatever. Also actually add some improvements, but hide the malware in those changes.

Good luck finding that. (brb going to try this)

raincole• 1 year ago

The whole thing worked only because they gamed open-vsx ranking algorithm.

notachatbot123• 1 year ago

Much less click-baity if a more descriptive title would have been used: "Malicious copy of Cursor AI extension used for $500k theft"

samrus• 1 year ago

The title does make it sound like the AI itself lead to the vulnerability, which is false

But cursor isnt off the hook. It wasnt a malicious copy, it was a legit copy of the cursor IDE distirbuting a package they allowed on the extension store. This is on them.

The lesson here is to not make a vscode fork if you arent able to maintian it the way microsoft does. Move fast and break (the user's) things i guess

worble2• 1 year ago

The article says they use open-vsx, which is managed by the Eclipse foundation. It's not really anything to do with cursor, other than the fact they're allowing you access to the only other vscode marketplace that all the forks use.

infecto4• 1 year ago

I am not so sure. They don’t own the registry for extension. Even in VSCode I always thought one should be cautious.

gametorch5• 1 year ago

Cursor is off the hook in my system of ethics.

If you're running code without reading it, that's on you.

The exploiter is evil. Cursor has no culpability here.

throwawayffffas4• 1 year ago

It's not their extension store.

infecto4• 1 year ago

Even better. Malicious copy of extension found on OpenVSX. Then in the opening paragraph mention the tools using this registry, like cursor.

joelthelion2• 1 year ago

So that guy used the same machine for development and holding 500,000$ in cryptos?

oc12• 1 year ago

Most people do.

joelthelion2• 1 year ago

Most people don't hold 500k in cryptos.

Holding that much money on a machine that is not ultra secure is borderline insane.

LikesPwsh• 1 year ago

Cryptocurrency contracts are going to touch actual tokens at some point.

Even if the compromise wasn't on the developer's machine, it could have enabled a supply chain attack post-deployment.

walls• 1 year ago

There are test networks, and anyone with more than $500 in crypto should be using a hardware wallet at this point.

Jhsto• 1 year ago

Thought the same thing, could it be a false claim to get a nice headline thus clicks on your site?

darkwater• 1 year ago

You know you are in a cycle when some new software/paradigm brings new solutions and approaches while it forgets about basic stuff already implemented for ages by prior solutions. It's basically like an adolescent. I guess this is how we evolve?

EDEdDNEdDYFaN• 1 year ago

clickbait title

it wasn't even a cursor specific extension it was a vscode one. completely misleading

dcastm2• 1 year ago

Seems VSCode quickly removed this extension from their marketplace: https://x.com/code/status/1943720372307665033?s=46

EZ-E• 1 year ago

Am I understanding right the extension was free to download code from internet and execute with enough rights to scan the user's disk? That is wild. Does this mean every company is one bad extension install away from having its entire codebase stolen or worse?

I naively assumed the extensions were 'sandboxed' to some degree.

delusional2• 1 year ago

These systems rely on downloading and executing much more untrusted software than you could ever imagine. Please dig deeper into this for yourself, I think that's the only way for anyone to truly appreciate the mess we are getting ourselves into.

sshine• 1 year ago

There is no ACL system in place for VSCode extensions, no.

Any extension has full access to execute programs as the user.

Your operating system might have some security measures in place.

bravesoul24• 1 year ago

Even with just internet access an extension could upload your entire codebase. Git extensions for example need this level of access by design. How else could you set a different remote and push all refs:)

pjc50• 1 year ago

Browser extensions are sandboxed. Editor extensions not at all.

liveoneggs• 1 year ago

but the editor is a browser!

muzzle• 1 year ago

I also naively thought that IDE extensions where sandboxed until I worked myself on making extensions.

Well, it’s absolutely not and you can access the full filesystem. Which is handy if you are legit, but very permissive & much more a security threat than I imagined.

Be careful what extensions you install people :)

ceejayoz• 1 year ago

Being careful won’t save you from the attacks we see with Chrome extensions, where they get bought by a bad actor.

addandsubtract• 1 year ago

VSCode on MacOS asks me if it can access my Download/Documents/etc folder... and if I trust the files in directory X that I just opened. Yet, extensions can just bypass all those safeguards?

IshKebab2• 1 year ago

Does this mean every company is one bad extension install away from having its entire codebase stolen or worse?

Yes.

I naively assumed the extensions were 'sandboxed' to some degree.

No. This is fairly obvious if you have used more than a few extensions - often they'll ask you to download and install binaries.

ants_everywhere3• 1 year ago

Am I understanding right the extension was free to download code from internet and execute with enough rights to scan the user's disk?

I honestly thought that was how the Javacsript and Python ecosystems worked? And surely many others.

cosiiine• 1 year ago

Zed for example will start crawling your home directory and all children if you don’t have a project open. Documents, downloads, etc all uploaded.

notpushkin5• 1 year ago

Source?

myaccountonhn• 1 year ago

See also: the millions of npm packages that get installed are one bad actor away from a disaster.

lmz• 1 year ago

It's nice how they still respected copyright by not copying actual useful code out of the original extension.

viraptor• 1 year ago

I don't get why they did that to be honest. Just copying the functionality from the other extension would let them catch so many more people.

jowea2• 1 year ago

Would it trigger a plagiarism detector somewhere?

dcastm2• 1 year ago

How do you stay safe from this kind of attacks?

Velorivox• 1 year ago

Easy: stay away from crypto.

pshirshov2• 1 year ago

Use hardware wallets, avoid running Windows, hash-pin your extensions with Nix and carefully review them in advance.

Asmod4n• 1 year ago

The System you keep your wallet on must be secured like a bank. Because the app can do nearly everything a bank can do (except refunds)

const_cast• 1 year ago

Multiple steps:

1. Be aware of remote code downloading and execution. VSC extensions are remote code. Try to find out if you trust the source. I trust Debian repos, I certainly do not trust the VSC marketplace.

2. Know the policies around sandboxing. VSC is not a browser, and does no sandboxing at all.

3. Containerize or virtualize the application. If you're on Linux, always use Flatpak. Deny all filesystem permissions except for your root source code directory. This goes for browsers, too. Ideally they should support xdg-download and then have zero file permissions at all - otherwise, only grant ~/Downloads. Don't want a zero-day stealing your files.

4. Keep sensitive data in a separate, encrypted place. On Linux, you can use KDE vaults.

In a perfect world, we wouldn't be downloading and running remote code at all. But for practically, this is untenable. I have JS enabled in my browser. Our best bet is limiting the blast radius when things go south.

ivanjermakov• 1 year ago

Dupe: https://news.ycombinator.com/item?id=44565994

pshirshov2• 1 year ago

But this is not about Cursor. It's a supply chain attack, and a Windows machine running a software wallet. A hardware wallet would make this impossible.

bravesoul24• 1 year ago

Hardware wallet makes this less likely. Yes.

TrackerFF• 1 year ago

Should be trivial to search for links inside the code for the extensions. Though attackers can obfuscate those trivially too.

voidUpdate2• 1 year ago

I'm surprised that you can still get .su (soviet union) domains. I'd have thought someone would have said that you can't buy them anymore

poly2it• 1 year ago

How much are you missing out on if you just ban *.su connections on your device?

voidUpdate2• 1 year ago

According to wikipedia, organisations with roots in the soviet union, the Donetsk People's Republic, white supremacist websites and cybercrime. So you can probably safely block it unless you're into those kinds of things.

EDIT: also student's unions apparently, which kinda makes sense

nubinetwork2• 1 year ago

Russia doesn't give a shit. https://en.wikipedia.org/wiki/.su

nottorp• 1 year ago

Can’t blame the LLM for once… clickbait title.

vultour• 1 year ago

The developer was well aware of the cybersecurity risks associated with crypto transactions, so he was vigilant and carefully reviewed his every step while working online.

Uses Cursor. Downloads random extensions.

Gigachad• 1 year ago

Tbh it’s literally impossible to use your computer normally and be vigilant enough to protect crypto. No one could ever properly audit everything they run.

dist-epoch• 1 year ago

It is possible.

Brand new laptop, stock Ubuntu on it, nothing else. If you don't want to go the Qubes OS way.

throw101010• 1 year ago

That's the reason why Hardware wallets exist. They aren't the panacea, but they drastically increase the separation of your keys from the Internet. Some (like ColdCard) do not ever need to touch an online computer directly.

For small amounts all these mobile/addons/desktop software are fine (with minimum caution like avoiding reckless behavior described in the OP). For larger amounts cold storage (of which hardware wallet are the easiest to deploy) will protect your funds.

When you put cash in your physical wallet you assume that this could be lost to a robber in the streets, with little to no recourse. You wouldn't put all your belongings in a big bag you would carry everywhere you travel, or if you did you would increase your security proportionally to this increased risk... if you don't, nobody would shed a tear over your potential losses.

Not sure how this is different with crypto, I guess people assume everything is safe by default because it has no physical form, despite the 20 warnings and security reminders they get when they setup any crypto wallets.

ratg13• 1 year ago

In this case it's literally as simple as not developing anything while playing around with a live wallet that has hundreds of thousands of dollars in it.

It's like trying to do vehicle maintenance while your car is running.

It might be technically possible.. but why would you ever do that?

OkPin• 1 year ago

This incident really underscores how AI-powered dev tools, which rely on open-source extension registries like Open VSX, can be weaponized via supply chain abuse. A $500k crypto heist via a bogus “syntax highlighter” signals a scary maturity in these attacks.

Ranking manipulation, using recency and inflated download counts, to outrank the legitimate Solidity package is a clever exploit of how developers search. It makes me wonder: should IDEs start validating package authorship or offer signed extensions as a default?

Also, the fact that this happened on a freshly imaged system with no antivirus suggests we need to rethink trust models for extension marketplaces. Not just for crypto devs, but for any industry sensitive to code integrity.

oc12• 1 year ago

We're getting back to the old age of antivirus software. Can't wait to install Norton or Kaspersky on my Mac M5. Also good time to start your antivirus ai startup.

OldfieldFund2• 1 year ago

Can you sell me your Mac M5, time traveller?

ljf• 1 year ago

(and it seems very likely the 'person' you are replying to is a bot/AI in this case too)

rubymamis2• 1 year ago

How's the extension able to run powershell commands with no warnings or permission requests? I assume this is type of attack is not possible on macOS?

rightbyte• 1 year ago

Why do we pretend executing malicious code is sandboxable?

It is a social problem not a technical problem.

nubinetwork2• 1 year ago

Make it a bash script, and it'll run almost anywhere...

rubymamis2• 1 year ago

Once the equivalent of "ScreenConnect" is downloaded and run on macOS, I assume Gatekeeper will not let it run?

oefrha2• 1 year ago

Wrong, bash scripts can pop up a series of permission prompts on macOS if you do a full disk scan. They’re only suppressed when directly run from an application like Terminal that’s already been given full disk access or developer tools permission. In fact, sometimes the syscall just silently fails with no permission popup. For instance I have this python script calling an HTTP endpoint on LAN that when run within tmux would sometimes inexplicably fail with no route to host error because it doesn’t have local network scan permission, there’s no permission prompt, and the only solution is to restart the tmux server.

rs1862• 1 year ago

This is basically RCE that can happen on any OS.

arnaudsm3• 1 year ago

Context : Cursor, despite raising $900M, is a vscode fork that uses the open-vsx extension registry. It is maintained by european volunteers at a non-profit, and does not have the resources to check for supply-chain attacks like this.

Freeloading on (and blaming) volunteer infrastructure is irresponsible, especially when you have so much funding.

Cthulhu_• 1 year ago

Cursor, Microsoft, and all the major players in this space should invest heavily in a managed dependency / plugin service, also for the huge amount of nodeJS package. They need a review, scan, certification and warranty program.

Apple did it 15 years ago, time for the rest to catch up. They can turn it into a business by offering enterprise subscriptions for higher guarantees or a warranty.

blibble• 1 year ago

the entire AI industry is based on mass parasitism of art, music, articles, newspapers, books and open source code

why would they start investing now when they can just continue to plunder the commons uninterrupted?

arnaudsm3• 1 year ago

Microsoft claims their team banned the extension in "2 seconds" https://x.com/code/status/1943720372307665033?s=46

Concerning Apple, their review process is so hard and unjust, I've seen startups give up apps after months of work just because of that.

Maybe sandboxing and runtime-level permissions are a better compromise?

manojlds• 1 year ago

Microsoft (claims) does that already. Their pitch is for people to use the main VSCode marketplace.

ants_everywhere3• 1 year ago

Freeloading on (and blaming) volunteer infrastructure is irresponsible, especially when you have so much funding.

I agree. If you're going to fork vscode, it's not that much harder to add a sandbox. Even a docker container would be better than nothing.

xinayder3• 1 year ago

How different is Cursor to VSCodium?

Nonetheless, I think this is more a vulnerability in the Open VSIX registry side, than Cursor AI. If anything, the forks and VS Code should block/sandbox extensions by default, or have a granular permission system to allow users to consciously choose whether to allow an extension to use network resources or not.

arnaudsm3• 1 year ago

Cursor is a paid product and a company, VSCodium is an open-source project running on volunteers.

TiredOfLife• 1 year ago

They also were freeloading on Microsoft infrastructure and when they got booted they also blamed everyone else.

Thanks to Cursor you can no longer directly download extensions from vs code marketplace.

mrkramer• 1 year ago

I'm always anxious when I download npm packages or when I pip Python packages...tbh it's a gamble because there are so many supply chain attacks and/or malicious developers.

samsk• 1 year ago

Thats why I always develop on a per customer mini VM via VSCode ssh remoting or similar, and projects are usually runned via docker-compose or devcontainers.

meander_water• 1 year ago

There's actually a new setting in vscode (from Dec 24) to configure a whitelist for extensions that are allowed to be installed on a user's machine [0]. It's not foolproof, but it probably helps to prevent common supply chain attacks. I wonder if this could be used in cursor too.

[0] https://code.visualstudio.com/docs/setup/enterprise#_configu...

benhurmarcel• 1 year ago

I dread the day our IT department gets their hands on that

braggerxyz• 1 year ago

Some crypto bro got scammed while being involed in some AI shit? How ironic.

Yet, the extension dilemma is also utterly shit. That's why I stay far away from "VSCode and friends"

throw74844852• 1 year ago

Downloading random code from internet is just normal development on Mac. Brew, npm and other sorts of "package managers".

I have code, passwords and certificates separated in virtual machines, even IDE GUI app is virtualized, and has no rights to access GitHub, internet or filesystem directly.

But I get a lot of flack from coworkers. They say it is unintuitive and uses x86 CPU which is uncool. Mac has no reasonable VM software or secure containers!

OldfieldFund2• 1 year ago

Mac has also much fewer Trojans/Stealers than Windows as far as I understand.

throw74844852• 1 year ago

But I am not on windows

signaleleven• 1 year ago

Somewhat humorously, my company displayed an IT warning telling me that I can't visit the website in question because it's in Russia. I probably set off some kind of alarm somewhere.

I do use Cursor at work and I have various extensions installed.

londons_explore• 1 year ago

If you want to know if you've fallen victim to such an attack, this might help:

https://serverthiefbait.com

It is a small crypto wallet you can hide in your computer and be notified when someone steals from it.

il-b• 1 year ago

Valuable wallets should only be accessed from designated devices with no unrelated software installed on them.

Code highlighting extension for Cursor AI used for $500k theft

Related Stories