PulseAugur
EN
LIVE 17:54:49

Trojanized Claude Code extension found on Cursor marketplace

By PulseAugur Editorial · [2 sources] ·

A malicious Claude Code extension, not developed by Anthropic, was available on the Cursor marketplace for approximately 11 hours on October 29th. This trojanized extension, versions 2.1.312 and 2.1.313, planted an "svc-telemetry" SSH key, established persistence, and created a reverse tunnel on affected systems. Users who installed the extension are advised to clean their systems and rotate credentials. AI

IMPACT Compromised AI-powered development tools can lead to supply chain attacks, impacting software integrity and user security.

RANK_REASON The cluster describes a malicious software component affecting a specific tool, not a core AI model release or research.

Read on Mastodon — mastodon.social →

AI-generated summary · Google Gemini · from 2 sources. How we write summaries →

Trojanized Claude Code extension found on Cursor marketplace

How we ranked this

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
The cluster describes a malicious software component affecting a specific tool, not a core AI model release or research.
Source corroboration
2 independent sources
Multiple independent publishers reporting the same story raises confidence that it's real and newsworthy.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
1 days old
Coverage has settled into its steady-state source set.

Full methodology in our editorial standards.

COVERAGE [2]

  1. Mastodon — mastodon.social TIER_1 English(EN) · burso ·

    Ransomware leak sites, Oct 26–Nov 1: 275 claimed victims (+24% w/w) from 43 groups. The Gentlemen led with 50, all on Oct 31, then Qilin (45). US: 34% of claims

    Ransomware leak sites, Oct 26–Nov 1: 275 claimed victims (+24% w/w) from 43 groups. The Gentlemen led with 50, all on Oct 31, then Qilin (45). US: 34% of claims. FBI seized Virtualine bulletproof hosting. Claims, not confirmed breaches. # Ransomware # ThreatIntel # CyberSecurity …

  2. Mastodon — mastodon.social TIER_1 English(EN) · burso ·

    A trojanized Claude Code extension (2.1.312/2.1.313), not built by Anthropic, sat in Cursor's marketplace for ~11h on Oct 29. It planted an "svc-telemetry" SSH

    A trojanized Claude Code extension (2.1.312/2.1.313), not built by Anthropic, sat in Cursor's marketplace for ~11h on Oct 29. It planted an "svc-telemetry" SSH key, persistence and a reverse tunnel. Installed it? Clean up and rotate creds. # SupplyChain # DevSecurity # Malware # …

RELATED ENTITIES

RELATED TOPICS