Trojanized Claude Code extension for Cursor hit developers
Original title: Devs Hit by Trojanized Claude Code Extension for Cursor
Malicious version 2.1.313 stole data and, in a minority of cases, could give persistent privileged access.
Anthropic’s official Claude Code extension in the Cursor marketplace was replaced with a backdoored build for 11 hours on October 29. Developers who downloaded or updated it received version 2.1.313, which took sensitive data and could give persistent privileged access in a minority of cases. Cursor says at most 5,000 users were affected and will be contacted. Separately the same day, researchers described an unrelated Cursor browser flaw that could deploy arbitrary code.
Unconfirmed: Cursor has not publicly confirmed how the extension was replaced or whether the separate browser flaw was exploited.
- The malicious listing ran from 9:27 a.m. GMT to 8:35 p.m. GMT.
- Attackers added a 66-line loader over the legitimate extension code.
- Cursor did not immediately answer questions about either issue.
- The browser code-execution flaw is described as unrelated.
Impact: Theft of sensitive data and possible persistent privileged access
| Product | Affected |
|---|---|
| Cursor Claude Code extension | 2.1.313 |
- 1.Check whether Claude Code 2.1.313 was downloaded or updated on October 29.
- 2.Wait for Cursor’s direct notice if counted among the affected users.
- Products
- Claude Code
- Organizations
- OpenSourceMalware
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=popular-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 1e51d280261e34e0cc1db58fc4422dce | tepad-updates-6-months#recipe=popular-items&sourcecontentid=1e51d280261e34e0cc1db58fc4422dce) Chinese Hackers Hijack Notepad++ Updates for 6 Months by |
| md5 | 42a3f64a30a24172cce0776514fc74fd | ntel-memory-encryption#recipe=popular-items&sourcecontentid=42a3f64a30a24172cce0776514fc74fd) Cheap Hardware Module Bypasses AMD, Intel Memory Encrypti |
| md5 | 43aa47a844577b6570bf4302ed195069 | ersecurity-claude-llms#recipe=popular-items&sourcecontentid=43aa47a844577b6570bf4302ed195069) In Cybersecurity, Claude Leaves Other LLMs in the Dust by |
From the original article
8 min read at darkreading.com
Two serious security issues hit Cursor on the same day, highlighting the risks for AI-powered integrated development environments (IDEs).
By Nate Nelson · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.