Threats in the Marketplace: Extension Updates

CRITICALSTART® Security Advisory · [CS-TR-26-1101B] Threats in the Marketplace – Extension Updates

Executive Summary

The CRITICALSTART® Cyber Research Unit (CRU) is tracking a threat pattern in which attackers exploit the established trust of legitimate software extensions to introduce malicious functionality after installation. Throughout 2026, reported attacks involved compromised publishing credentials, malicious updates, extension ownership transfers, and vulnerabilities in legitimate extensions across developer tools, browser extensions, and artificial intelligence (AI) assistants.^[1-6] These incidents demonstrate how established software identities and distribution channels can be exploited to bypass traditional trust decisions.

Rather than convincing users to install unfamiliar software, attackers can leverage extensions already present in organizational environments to target developer credentials, sensitive information, and privileged application access. The resulting risk extends beyond the extension itself to the systems, accounts, and enterprise resources accessible through its permissions. CRU assesses that extension integrity must be evaluated throughout the software lifecycle, not solely at installation. Organizations should prioritize monitoring publisher and version changes, protecting publishing credentials, reviewing extension privileges, and selectively delaying updates to high-risk extensions to reduce exposure to compromised releases.

Introduction

The first part in this series examined extensions that were malicious at installation. This part examines extensions that were legitimate when installed before assuming a malicious identity. Users and organizations generally identify extensions through publisher names, extension identifiers, marketplace listings, and reputation. These identifiers remain stable while the underlying code changes repeatedly.

Automatic updates deliver security fixes, compatibility improvements, and new features, but the same mechanism can distribute malicious code if an attacker compromises the publisher's credentials or another part of the release process. Unlike a counterfeit extension, which must persuade users to install an unfamiliar product, a malicious update inherits an extension's installed user base. The attacker bypasses the most visible trust decision, which is whether to install the extension at all. Two incidents in 2026 show how consequential that distinction can become.

Nx Console: Compromised Update with Enterprise Consequences

On May 18, 2026, attackers published version 18.95.0 of Nx Console, a Visual Studio Code (VS Code) extension with more than 2.2 million reported installations, under its legitimate extension identity. StepSecurity attributed the compromise to a contributor's GitHub token, which an earlier supply chain attack had exposed, and which had access to the project repository and, directly or indirectly, the marketplace publishing process. The malicious release executed when a developer opened a workspace, retrieved an additional payload, and targeted developer credentials, cloud access tokens, and continuous integration and continuous delivery (CI/CD) secrets.^[1]

A short distribution window did not limit the consequences. GitHub reported the exfiltration of approximately 3,800 internal repositories after an employee device executed a poisoned extension, and Nx representatives indicated that installations of the malicious release might have exceeded 6,000, well above the initial marketplace estimate of 28.^{[1, 2]} These figures describe different things: the extension's installation base, the estimated distribution of the malicious version, and the reported downstream impact. They should not be combined into a single victim count.

Claude Code: Legitimate Identity, Modified Packages

On October 29, 2026, maliciously modified packages of the Claude Code extension were available in the Cursor extension marketplace for approximately eleven hours, between 2:27 a.m. and 1:35 p.m. Pacific Time (PT). Cursor estimated that at most 5,000 users were affected and, in updated guidance, identified versions 2.1.312 and 2.1.313 for Windows and macOS.^{[3, 7]} The packages used the legitimate anthropic.claude-code extension identity but contained code that Anthropic did not develop.^[3]

According to Cursor, the payload attempted to add an attacker-controlled Secure Shell (SSH) key, enable the local SSH service, and create a reverse tunnel, and it collected operating system details, working directories, and environment variable names.^[3] Enabling the SSH service generally requires administrator privileges that the extension lacks on most Windows and macOS systems, so that step could fail and prevent tunnel access, although key placement and persistence could still occur.^[3] The presence of malicious code therefore does not establish that attackers obtained interactive access to each affected host.

The method by which the packages entered the distribution channel has not been publicly established, and reporting differs on the role of Open VSX.^{[7, 8]}

Additional Threat Patterns

The Nx Console and Claude Code incidents illustrate how attackers can exploit trusted extension identities and distribution mechanisms to introduce malicious code into established environments. Beyond compromised publishing credentials and malicious package distribution, threat actors can exploit trusted extensions through several other mechanisms. These include introducing malicious functionality through subsequent updates, acquiring established extensions and leveraging their existing publisher reputation, and exploiting vulnerabilities that expose privileged extension capabilities. The following cases illustrate how each approach can turn otherwise legitimate extensions into attack vectors.

Gradual Malicious Behavior

Some operators publish apparently benign software and introduce harmful functionality through later updates. In June 2026, Socket reported two extensions branded VPN Go, distributed through the Chrome and Firefox marketplaces, that provided visible virtual private network (VPN) or proxy functionality and added clipboard-stealing behavior in later versions.^[4] The Firefox extension repeatedly checked clipboard contents and transmitted collected text to attacker-controlled infrastructure.^{[4, 9]}

Socket reported 146 Chrome users and 3,499 Firefox users at the time of its investigation, comparatively small figures that do not reduce the importance of the mechanism.^[9] Clipboard contents can include credentials, wallet addresses, and private communications, so the impact depends on what affected users copied while the behavior was active. The case shows that extension behavior can change without a corresponding change in the user's understanding of what the extension does.

Ownership Changes and Publisher Continuity

Extension ownership can change through sale, transfer, abandonment, or acquisition. Research reported in August 2026 described Chrome and Edge extensions associated with a modular malware framework, of which five had been acquired from legitimate developers and then received malicious updates.^{[5, 10]} Unlike impersonation, this approach gives the attacker control of the product or its publishing channel, and the listing's historical reputation can remain intact while the behavior and incentives of its operator change.

Legitimate Extensions as Attack Intermediaries

A legitimate extension can contain vulnerabilities that allow a malicious website, an unrelated attacker, or a lower-privileged extension to abuse its capabilities. In June 2026, Forever Security disclosed vulnerabilities in the SiderAI and MaxAI Chrome extensions, which it reported at approximately 10 million and 1 million installations.^[6] The flaws involved content scripts that processed requests originating from untrusted web pages. In MaxAI, a website could open hidden tabs to services such as Gmail and Google Calendar and capture screenshots, and the researchers reported that visiting a malicious website was sufficient.^[6] The installation figures reflect reported distribution and do not represent confirmed exploitation.

Separately, LayerX reported that the Claude in Chrome extension trusted the claude.ai origin and not the execution context, so another extension with no declared permissions could send commands to the assistant.^[11] The initial fix was partial, no Common Vulnerabilities and Exposures (CVE) identifier was assigned, and Manifold Security later reported two related flaws still present in version 1.0.80.^{[12, 13]}

The underlying issue is privilege delegation. AI assistant extensions interact with multiple sites, inspect browser content, and act for authenticated users, so inadequately validated input from untrusted pages or extensions can influence privileged operations.

Automatic Update Controls

Automatic updating is an essential part of software security, because it reduces exposure to known vulnerabilities, and disabling it would create significant problems of its own. One mitigation is a delay between marketplace publication and automatic installation. Microsoft introduced a default two-hour extension auto-update delay in VS Code 1.123 and made it configurable through the extensions.autoUpdateDelay setting, including through organizational policy, in version 1.125.^{[14, 15]} The delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI.^[14]

CRU posits that a two-hour delay would have exceeded the eleven-minute Nx Console publication window, but would not necessarily have stopped an attack available for approximately eleven hours, as in the Cursor incident. A release delay does not replace package analysis, publisher security, or runtime monitoring, and its effectiveness depends on how quickly malicious releases are discovered. InfoQ notes research indicating that a seven-day cooldown would have stopped 8 of 10 analyzed supply chain attacks.^[16] Organizations can apply the control selectively, holding updates longer for widely installed or highly privileged extensions and allowing low-risk extensions to update quickly.

MITRE ATT&CK Technique Mapping

The table maps observed behavior to the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework.

Implications for Organizations

These incidents indicate that extension governance should operate as a continuous security function and not as a one-time approval. Organizations need accurate inventories of installed extensions, identifiers, versions, publishers, and deployment locations across both browser and developer endpoints. Approval should reflect the sensitivity of the environment, because extensions on developer workstations with access to source code, production credentials, and cloud infrastructure warrant closer scrutiny than low-privilege tools in isolated contexts.

New permissions, ownership transfers, significant code changes, and unexpected network communications can each justify reassessment. Publisher accounts and release pipelines also require protection, because stolen credentials can undermine marketplace trust even when the original software is legitimate. Response must extend beyond uninstalling the extension. Where malicious code executed, investigators should assess credential exposure, persistence, unauthorized access, and downstream compromise.

Organizational Mitigation Strategies

To mitigate risks associated with compromised and vulnerable marketplace extensions, we recommend the following:

Immediate (within 24 hours)

• Identify the trojanized Claude Code packages: Search Cursor and Open VSX-based editor installations for anthropic.claude-code versions 2.1.312 and 2.1.313, review ~/.ssh/authorized_keys for the svc-telemetry key, and apply Cursor's published remediation guidance. Rotate credentials accessible from affected hosts using a clean system.^[3]
• Identify the compromised Nx Console release: Search developer hosts, virtual desktop images, and CI images for nrwl.angular-console version 18.95.0. Treat affected hosts as compromised, update to version 18.100.0 or later Patched: 18.100.0+, remove persistence artifacts, and rotate reachable credentials, including secrets held in cloud secret stores and password managers.^[1]
• Review VPN and AI assistant extensions: Remove the VPN Go extensions, update Claude in Chrome to the latest version, and assess SiderAI and MaxAI against vendor responses.^{[4, 6]}

Short-Term (within two weeks)

• Hold updates for high-privilege extensions: Maintain the VS Code update delay, increase it for high-privilege extensions through the extensions.autoUpdateDelay policy, and place editors without an equivalent control behind internal mirrors or staged update rings.^[15]
• Monitor publisher and version changes: Pin business-critical extensions by identifier, publisher, and version, and alert on ownership changes, new permissions, and unexpected network behavior.^[10]
• Detect editor-spawned execution: Alert on shell commands or background tasks that code editors start at launch or workspace open, which is how the Nx Console payload executed.^[1]

Structural

• Reduce standing credentials on developer hosts: Use short-lived tokens and centralized secrets management, because the Nx Console and Claude Code payloads targeted stored credentials and host access.^{[1, 3]}
• Protect extension publishing credentials: Organizations that publish extensions should enforce multi-factor authentication, scope and rotate publishing tokens, and review OAuth (Open Authorization) consent requests.^[1]
• Treat AI assistants as privileged software: Review agentic and AI assistant extensions with the same rigor as other tools that hold session access to mail, documents, and code, and limit modes that act without confirmation.^{[6, 11]}

Conclusion

Extension risk does not end at marketplace approval. Compromised publishing processes, malicious updates, changed ownership, and vulnerabilities in legitimate extensions allow attackers to exploit trust that already exists. Organizations should therefore evaluate whether an extension remains trustworthy as its code, ownership, privileges, and operating environment change, and should treat continuous extension assurance as part of software supply chain security.

This advisory was written using the best intelligence available at the time and is subject to change as additional information becomes available. Visit Critical Start's Resources page for threat research articles and security advisories, including Threats in the Marketplace: Malicious Extensions.

Further Reading

1. Kurmi, A., StepSecurity (May 18, 2026). Nx Console VS Code Extension Compromised.
2. The Hacker News (May 21, 2026). GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension.
3. Cursor (Oct. 29, 2026). Security notice: malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace (updated Oct. 30, 2026).
4. Socket (Jun. 29, 2026). Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates.
5. Toulas, B., BleepingComputer (Aug. 30, 2026). Chrome Web Store extensions caught stealing crypto, browser data.
6. Weizman, G., and Bashan, G., Forever Security (Jun. 10, 2026). MaXSS & Spyder: How two Chrome extensions allow websites to compromise over 10 million browsers.
7. The Hacker News (Oct. 30, 2026). Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor.
8. StepSecurity (Oct. 30, 2026). Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines.
9. CyberInsider (Jun. 2026). Chrome and Firefox Free VPN extensions caught stealing clipboard data.
10. CyberInsider (Aug. 2026). 19 Chrome and Edge extensions caught harvesting crypto wallet seeds.
11. SecurityWeek (May 8, 2026). Vulnerability in Claude Extension for Chrome Exposes AI Agent to Takeover.
12. OrcaRouter (May 2026). ClaudeBleed: any Chrome extension could drive Claude.
13. Manifold Security (2026). ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail.
14. Lakshmanan, R., The Hacker News (Jun. 8, 2026). VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks.
15. Microsoft (Jun. 17, 2026). Visual Studio Code 1.125 release notes: Configurable extension auto-update delay.
16. InfoQ (Jun. 2026). VS Code 1.123 Adds Two-Hour Extension Update Delay to Limit Supply Chain Attacks.

Appendix: Indicators of Compromise