PulseAugur
EN
LIVE 00:56:51

Malicious Claude Code Extension Exposed 5,000 Developers on Cursor

By PulseAugur Editorial · [1 sources] ·

A malicious version of the Claude Code extension (v2.1.313) was available on the Cursor marketplace for approximately 11 hours on October 29th. This tampered extension, downloaded by around 5,000 developers, contained a JavaScript loader that, upon loading, could steal SSH keys and establish persistent access through methods like LaunchAgents or scheduled tasks. While the extension was designed to plant backdoors, certain setup bugs limited the extent of the attackers' access. AI

IMPACT Highlights risks in AI tool supply chains and the need for robust security in AI-powered development environments.

RANK_REASON A security vulnerability in a third-party tool that integrates with AI models.

Read on Mastodon — mastodon.social →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

Malicious Claude Code Extension Exposed 5,000 Developers on Cursor

How we ranked this

Signal score
12 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
A security vulnerability in a third-party tool that integrates with AI models.
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
Breaking (< 6h)
Fresh story with cross-source coverage still developing. Ranking may shift as more sources report.

Full methodology in our editorial standards.

COVERAGE [1]

  1. Mastodon — mastodon.social TIER_1 English(EN) · [email protected] ·

    🤖 Supply-chain: a tampered Claude Code extension (v2.1.313) sat on Cursor's marketplace for 11h on Oct 29, ~5,000 devs exposed. A JS loader prepended to extensi

    🤖 Supply-chain: a tampered Claude Code extension (v2.1.313) sat on Cursor's marketplace for 11h on Oct 29, ~5,000 devs exposed. A JS loader prepended to extension.js runs on load: attacker SSH key, reverse tunnel, LaunchAgent/scheduled-task persistence. Setup bugs limited access.…

    LINKS bleepingcomputer.com/…/malicious-claude-c…

RELATED ENTITIES

RELATED TOPICS