{
  "type": "bundle",
  "id": "bundle--169f49f8-0102-4834-879d-b1cc17a2422c",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-29T00:00:00.000Z",
      "modified": "2026-10-29T00:00:00.000Z",
      "name": "Optimus Labs · Civilizations",
      "identity_class": "organization",
      "description": "Threat research team at Optimus Labs. Agentic AI attack surface research.",
      "contact_information": "https://optimuslabs.io/research/briefings"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--ea62b1c0-0102-4834-8149-f160ceb6509f",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-29T00:00:00.000Z",
      "modified": "2026-10-29T00:00:00.000Z",
      "name": "Claude Code Extension: The Update Was the Backdoor",
      "description": "Tampered builds of the Claude Code extension, 2.1.312 and 2.1.313, sat in Cursor's extension store for about 11 hours under the real publisher ID. Up to 5,000 developers installed them as a normal update. Anthropic did not build them.\n\nFor about 11 hours on Oct 29, Cursor's extension store served tampered builds of Anthropic's Claude Code extension under its real publisher ID, anthropic.claude-code. It was not a typosquat. Editors set to auto-update installed it with no click. A 66-line loader ran as soon as Cursor opened: it added an attacker SSH key, set itself to restart on every boot, reported the host and the names of secret environment variables, and kept trying to open a tunnel to 134.209.82.225. A bug stopped the attacker logging in on most machines. The next one may not make that mistake.",
      "published": "2026-10-29T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Plugin",
        "Package",
        "Credential",
        "severity:high"
      ],
      "object_refs": [
        "indicator--d5ecc73b-0103-474b-82b1-0bf90d6f04e8",
        "indicator--634fc178-0104-4c1e-824b-dd666453dd96",
        "software--0883ba8e-0102-499a-8981-43140986b428",
        "software--1b097b7c-0103-4464-8a0a-3f181c0cbfe0",
        "software--f00dcbb4-0103-47ee-8ef1-73a6f11113a2"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://optimuslabs.io/research/briefings/claude-code-extension-cursor-marketplace-backdoor"
        },
        {
          "source_name": "Cursor: Security notice, malicious Anthropic.claude-code 2.1.312 and 2.1.313 (Oct 29, 2026)",
          "url": "https://cursor.com/blog/claude-code-extension-security-notice"
        },
        {
          "source_name": "Phorion: Official Claude Code extension compromise, security advisory (Oct 30, 2026)",
          "url": "https://phorion.io/blog/offical-claude-code-vsx-compromise/"
        },
        {
          "source_name": "OpenSourceMalware: Trojanized Claude Code extension plants an SSH backdoor (Oct 30, 2026)",
          "url": "https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor"
        },
        {
          "source_name": "Microsoft Security: Inside a malicious Claude Code-branded extension (Oct 30, 2026)",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/"
        },
        {
          "source_name": "Wired: A supply chain attack put malicious Claude extensions on thousands of devices (Oct 30, 2026)",
          "url": "https://www.wired.com/story/trojan-malware-targets-thousands-of-anthropic-claude-developer-systems/"
        },
        {
          "source_name": "Socket: Cursor removes malicious Claude Code 2.1.313 extension (Oct 30, 2026)",
          "url": "https://socket.dev/blog/claude-code-extension-compromise"
        },
        {
          "source_name": "Ars Technica: Anthropic VS Code extension on Cursor backdoored for nearly 12 hours (Oct 30, 2026)",
          "url": "https://arstechnica.com/security/2026/10/anthropic-vs-code-extension-on-cursor-backdoored-for-nearly-12-hours/"
        },
        {
          "source_name": "Hacker News: Anthropic's Felix Rieseberg on the incident",
          "url": "https://news.ycombinator.com/item?id=50300683"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d5ecc73b-0103-474b-82b1-0bf90d6f04e8",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-29T00:00:00.000Z",
      "modified": "2026-10-29T00:00:00.000Z",
      "name": "ipv4: 134.209.82.225",
      "description": "Outbound traffic to 134.209.82.225 on ports 22 or 8099",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '134.209.82.225']",
      "pattern_type": "stix",
      "valid_from": "2026-10-29T00:00:00.000Z",
      "labels": [
        "claude-code-extension-cursor-marketplace-backdoor",
        "plugin",
        "package",
        "credential"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--634fc178-0104-4c1e-824b-dd666453dd96",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-29T00:00:00.000Z",
      "modified": "2026-10-29T00:00:00.000Z",
      "name": "file: extension.js",
      "description": "extension.js SHA-256 starting ecb58cb2 and ending 3ab6bf15",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'extension.js']",
      "pattern_type": "stix",
      "valid_from": "2026-10-29T00:00:00.000Z",
      "labels": [
        "claude-code-extension-cursor-marketplace-backdoor",
        "plugin",
        "package",
        "credential"
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--0883ba8e-0102-499a-8981-43140986b428",
      "name": "Cursor"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--1b097b7c-0103-4464-8a0a-3f181c0cbfe0",
      "name": "Anthropic"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f00dcbb4-0103-47ee-8ef1-73a6f11113a2",
      "name": "Microsoft"
    }
  ]
}