Ciphero advisories

AI supply-chain advisories

Malicious extensions, packages and MCP servers that target people building with AI, as the Ciphero platform tracks them. What's affected and what to do.

Check your machine with Cassandra, free → One read-only command, about ten seconds.

One email when we publish a new advisory. Unsubscribe in one click.

critical Malicious Claude Code extension 2.1.313 (Cursor marketplace) CSA-2026-0001 · Malicious extension

A malicious build of the Claude Code extension, version 2.1.313, was published to Cursor's extension marketplace for about eleven hours. It sent host and user details to an attacker server, added an attacker SSH key to authorized_keys, and set up a persistent reverse SSH tunnel (a LaunchAgent on macOS, a scheduled task on Windows). Anthropic did not build it.

Affected
anthropic.claude-code 2.1.313 in Cursor
Window
Oct 29, 2026, 2:27 am to 1:35 pm Pacific
Network
134.209.82.225 (ports 8099, 22)
SSH key
svc-telemetrySHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk
Persistence
com.apple.sysmondSysMon
Files
~/Library/LaunchAgents/com.apple.sysmond.plist~/.config/.smt~/.config/.smtk$TMPDIR/.stk_*/tmp/.stk_*%USERPROFILE%\.config\smt.cmd%USERPROFILE%\.config\smtk%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd%TEMP%\.stk_*
VSIX SHA-256
432ccdee3801f99e52b8fe31f69ea9870118e96ea7ef9ecabed1479621b5ab623de1722901165769893bef57c72594e9a54459faa23f3091b136b79966edd081

What to do

  1. Run Cassandra on every machine that runs Cursor. It looks for this backdoor's SSH key, persistence and tunnel.
  2. If Claude Code updated in Cursor during the window above, treat the machine as exposed: rotate its SSH keys, cloud and API credentials and Git tokens from a different machine.
  3. Update Claude Code to 2.1.314 or later and restart Cursor.
  4. Where traces are found, disconnect the machine and run Cursor's remediation script from the notice.
Check your machine, free Source Permalink
critical Malicious postmark-mcp server copies every email it sends MAL-2025-47604 · Malicious MCP server

Impersonates Postmark's MCP server; from version 1.0.16 it copies every email it sends to an outside address (reported by Koi Security, September 2025).

Affected
postmark-mcp (npm)

What to do

  1. Remove postmark-mcp from every MCP config on every machine.
  2. Treat everything it handled as exposed and rotate the credentials it was given.
Find it on every machine with AI Discovery Source Permalink
critical mcp-remote runs commands sent by a malicious MCP server CVE-2025-6514 · Vulnerable MCP server

A malicious remote MCP server can run commands on the machine through the OAuth flow.

Affected
mcp-remote <0.1.16 (npm)
Fixed in
0.1.16

What to do

  1. Upgrade mcp-remote to 0.1.16 or later.
  2. Pin exact versions in MCP configs, so a new release never runs unreviewed.
Find it on every machine with AI Discovery Source Permalink
high Filesystem MCP server reads and writes outside its allowed folders CVE-2025-53109 / CVE-2025-53110 · Vulnerable MCP server

Symlink and path-prefix checks can be bypassed to read and write outside the allowed directories.

Affected
@modelcontextprotocol/server-filesystem <0.6.3, >=2025.0.0 <2025.7.1 (npm)
Fixed in
2025.7.1

What to do

  1. Upgrade @modelcontextprotocol/server-filesystem to 2025.7.1 or later.
  2. Pin exact versions in MCP configs, so a new release never runs unreviewed.
Find it on every machine with AI Discovery Source Permalink
critical MCP Inspector lets any website run commands on your machine CVE-2025-49596 · Vulnerable MCP server

Unauthenticated inspector proxy lets a website run commands on the machine.

Affected
@modelcontextprotocol/inspector <0.14.1 (npm)
Fixed in
0.14.1

What to do

  1. Upgrade @modelcontextprotocol/inspector to 0.14.1 or later.
  2. Pin exact versions in MCP configs, so a new release never runs unreviewed.
Find it on every machine with AI Discovery Source Permalink

Cassandra also checks every editor and browser extension on a machine against public lists of known-malicious ones. Check yours