The name on the package

Anthropic.claude-code. Version 2.1.313. Eleven hours on the shelf. Between 2:27 a.m. and 1:35 p.m. Pacific on Thursday, a build carrying that name and number sat in Cursor's extension marketplace. On load, before the real extension code ran, it appended an attacker's key to `~/.ssh/authorized_keys`, dropped a LaunchAgent named to pass for an Apple component and dialed a reverse SSH tunnel out to a rented server. Reuters has Cursor's count: up to 5,000 users.

Then came the argument over whose pipeline it was. Kevin Beaumont, who reads these incidents as well as anyone, wrote flatly that Anthropic got compromised. Phorion's advisory, as first shared, put the bad bundle on Open VSX, the open registry most VS Code forks draw from. It now says Cursor's marketplace. OpenSourceMalware posted an update saying Cursor had told it the origin was Cursor's own store, not Open VSX. Cursor's notice was the flattest of all:

Set aside who's right. The people in that argument had the sample, the hashes and the attacker's IP address, and they still spent most of a day settling which store had served the bytes. The developer who clicked install had only the name. That is the failure worth fixing. An extension's identity tells you who wrote the code. It tells you nothing about who built and served the copy on your disk.

That gap mattered less when there was effectively one store. There isn't anymore. Microsoft's terms limit its marketplace to its own products, so every fork, Cursor first among them, ships extensions from somewhere else: Open VSX or a marketplace of its own. A popular extension now exists as several copies under one name, each moved by a different pipeline. Anthropic could run a flawless release process and still have its name on a build it never touched, in a store it doesn't operate. Cursor says it rotated its keys and rebuilt the marketplace, which is what you do when your own pipeline is in question.

The copy matters more for this extension than for most. An AI coding agent is the one tool developers deliberately hand their shell, their repos and their environment. The implant didn't have to steal a secret to be useful. It reported the names, not the values, of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP. That's a shopping list, and whoever reads it decides whose laptop is worth a login.

An extension's identity tells you who wrote the code. It tells you nothing about who built and served the copy on your disk.

The fair objection is that the system worked. Cursor caught it in eleven hours, capped the exposure at 5,000 installs, got the server taken offline and published remediation scripts the same day. Most of the payload's privileged steps failed anyway. On macOS it misread an admin-access error as Remote Login already being on, so it never enabled SSH. And npm and PyPI carry the same risk; a publisher signature doesn't help when the publisher's own keys are stolen.

All true, and all about the store, which is the thing that failed. Fast response is the second line of defense. The first is an editor that can check, at install time, that the bytes came from the author, with a publisher signature it verifies no matter which shelf the copy sat on. A signature from the store proves only that the store served it. With an author-level check, Cursor's sentence stops being a claim everyone takes on trust and becomes a fact an editor can enforce by refusing the install. The bug that saved most Macs was the attacker's, and the next attacker will fix it.

Anthropic.claude-code, version 2.1.313. The name was real. The version number was real. The only false thing about the package was the one thing the install button couldn't show you: where it came from.