A poisoned update to a popular developer extension showed how quickly a supplier becomes an attack vector. Poland's amended KSC Act is clear: responsibility for service security stays with the company.
What happened and why it matters
On 29 October 2026, for roughly eleven hours, the extension marketplace of the Cursor code editor distributed a modified version of the Claude Code extension – under the genuine publisher's name and as a routine update. According to Cursor's security notice, versions 2.1.312 and 2.1.313 for Windows and macOS were malicious. The code added an attacker's SSH key to authorized_keys (innocuously labelled svc-telemetry), tried to open a reverse SSH tunnel, installed persistence and sent host information to the attacker's server, including the names of environment variables containing words such as KEY or TOKEN. Sekurak, citing Cursor, reports up to 5,000 potentially affected users.
Nobody at the affected companies made a classic mistake: no one clicked a phishing link or installed pirated software. They trusted a supplier's update channel. That is the essence of supply chain risk – and it is exactly the area that Poland's amended Act on the National Cybersecurity System (the KSC Act) places on the company, not on the supplier.
What the amended KSC Act says
The amendment implementing the NIS2 Directive was published in the Journal of Laws (Dz.U. 2026, item 252) and has been in force since 3 April 2026. For mid-sized companies in covered sectors (including selected manufacturing, transport, digital services and parts of financial services), the timeline is what matters:
| Deadline | Obligation |
|---|---|
| 3 October 2026 | registration in the list of essential and important entities (now passed – anyone who missed it should catch up urgently) |
| 3 April 2027 | information security management system, incident handling, connection to the S46 system |
| 3 April 2028 | first mandatory audit for essential entities (except former operators of essential services), then at least every 3 years |
Source of deadlines: Polish Ministry of Digital Affairs (gov.pl), confirmed by Forsal.
Supply chain security is not an add-on here. The NIS2 Directive explicitly lists it among mandatory risk management measures (Article 21(2)(d)), including relationships with direct suppliers and service providers. The Polish act follows the same logic: an entity is responsible for the security of the service it provides as a whole, regardless of whether a given component is run in-house or bought externally (see Anna Szymańska's commentary in CyberDefence24).
Two further mechanisms directly affect supplier relationships:
- High-risk vendors – the minister responsible for digital affairs, following a procedure involving the Cybersecurity College, may designate a supplier as a high-risk vendor. Essential and important entities may then not introduce its products, and products already in use must be withdrawn within a set period. The President referred these provisions to the Constitutional Tribunal for follow-up review, but they are in force.
- Fines – for essential entities up to EUR 10 million or 2% of annual turnover; for important entities up to EUR 7 million or 1.4% of turnover (per Prawo.pl; thresholds consistent with Article 34 of NIS2).
The takeaway for the board is simple: an outsourcing contract transfers the work, not the responsibility.
Where companies will actually stumble
From an IT director's perspective, the biggest risks are not exotic attacks but everyday practice:
- No complete list of ICT suppliers. Finance knows the suppliers it pays. IT knows the systems it maintains. Nobody knows the plugins, browser extensions, SaaS tools bought on a card by marketing, or "temporary" integrations. The Cursor incident hit precisely the layer that rarely makes it into registers: developer tools.
- Automatic updates without distinction. Fast patching is good practice, but an update is also a channel for delivering code nobody has verified. Decide deliberately what updates immediately (e.g. OS security patches) and what updates with a short delay.
- Contracts without teeth. A typical contract with an integrator or SaaS provider includes no audit right, no incident notification deadline and no exit plan. After the amendment, that is a gap that is hard to explain to an auditor.
- Workstations with broad access. An administrator's or developer's laptop holding keys to the cloud, repositories and production is worth more to an attacker than a server. The malicious extension was harvesting exactly the names of variables holding tokens and keys.
- Exit plans on paper only. If a supplier is designated high-risk or is compromised, replacing it takes months. Without a plan prepared in advance, service continuity is at risk.
Checklist: IT supply chain in 90 days
Inventory (days 1–30)
- [ ] Build an ICT supplier register: systems, cloud services, integrators, maintenance, workstation software – including IDE and browser extensions.
- [ ] Combine data from three places: finance (invoices), IT (CMDB, endpoint management console), business units (tools bought independently).
- [ ] Classify suppliers: critical (failure or compromise stops the service or exposes data), significant, other.
Assessment and contracts (days 31–60)
- [ ] For critical suppliers, carry out a risk assessment: certifications, incident history, data processing location, subcontractors, the supplier's own regulatory status.
- [ ] Add to contracts: audit rights, an incident notification deadline aligned with your own reporting obligations, minimum technical requirements, a duty to report changes of subcontractors and ownership, and an exit clause with data handover.
- [ ] Check whether any supplier is subject to high-risk vendor proceedings.
Technical controls (days 61–90)
- [ ] Introduce an allow-list of IDE and browser extensions; block installation of anything else on managed endpoints.
- [ ] Set an update policy: security patches – fast; developer tools and plugins – with a 24–72 h delay or once released to the stable channel.
- [ ] Monitor changes to
authorized_keys, new scheduled tasks, LaunchAgents and startup entries – typical signs of persistence. - [ ] Reduce secrets on workstations: short-lived tokens, a secrets manager instead of environment variables, separate accounts for production.
- [ ] Prepare a "compromised supplier" procedure: host isolation, credential rotation, communication, criteria for reporting an incident to CSIRT.
- [ ] For your 3–5 most important suppliers, write a replacement plan: alternative, transition time, decision owner.
Ongoing
- [ ] Review the supplier register quarterly and whenever ownership, subcontractors or service scope change.
- [ ] Report to the board: number of critical suppliers, contract status, open risks. Management accountability for cybersecurity is one of the pillars of the new KSC Act.
Summary
The poisoned-extension incident is not an exception but another reminder that the software delivery channel is part of the attack surface. The amended KSC Act gives companies until 3 April 2027 to implement their obligations, but a supplier register, revised contracts and an exit plan take months, not weeks. Start with the inventory – you cannot manage the risk of a supplier you do not know you have.
If your company is still working out whether and how the act applies, a good starting point is NIS2 for mid-sized companies: where to start.
Sources
- Act of 23 January 2026 amending the Act on the National Cybersecurity System, Dz.U. 2026 item 252 (ELI) (in Polish)
- Ministry of Digital Affairs: KSC amendment – obligations of essential and important entities (in Polish)
- Forsal: KSC amendment in force – key deadlines and obligations until 2028 (in Polish)
- Prawo.pl: The President signed the KSC Act and referred it to the Constitutional Tribunal (in Polish)
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- [CyberDefence24, A. Szymańska: Outsourcing without outsourcing responsibility [OPINION] (in Polish)](https://cyberdefence24.pl/cyberbezpieczenstwo/poradniki/outsourcing-bez-outsourcingu-odpowiedzialnosci-jak-zabezpieczyc-lancuch-dostaw-podmiotu-krytycznego-opinia)
- Sekurak: Malicious Claude Code update in Cursor Marketplace (in Polish)
- Cursor: Claude Code extension security notice
- OpenSourceMalware: Trojanized Claude Code extension plants persistent SSH backdoor
This article is for information only and is not legal advice.
✦ This text was prepared by an AI agent and reviewed by the author before publication.