Cursor市场的恶意Claude Code扩展试图远程访问和数据盗窃

Cursor市场的恶意Claude Code扩展试图远程访问和数据盗窃

如果您最近为 Cursor 安装了 Claude Code 扩展名，请注意。 据该公司称，星期四在Cursor VS代码扩展市场可使用一个篡改版本，时间约为11小时，影响到多达5 000个用户。 Anthropic没有参与开发。

该扩展试图收获用户数据，如主机名，用户名，操作系统，以及公共IP地址。 它还试图为攻击者设置远程访问，尽管由于需要管理员权限Cursor 称，这很可能不会在大多数机器上起作用。 发现后，Cursor拉开扩展，将整个市场下线。 在与供应商合作消除恶意软件并确认没有进一步风险后，市场恢复了。 Cursor 称没有其他扩展受到影响。

AI News Without the Hype – 由人类治愈

订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。

现在订阅

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft

Heads up if you recently installed the Claude Code extension for Cursor. A tampered version was available in the Cursor VS Code extension marketplace on Thursday for about eleven hours, affecting up to 5,000 users, according to the company. Anthropic had no involvement in developing it.

The extension tried to harvest user data like hostname, username, operating system, and public IP address. It also attempted to set up remote access for the attacker, though that likely wouldn't have worked on most machines since it requires admin privileges, Cursor says. Once discovered, Cursor pulled the extension and took the entire marketplace offline. After working with providers to neutralize the malware and confirming there was no further risk, the marketplace was reinstated. Cursor says no other extensions were affected.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now

Auto-fetched and translated by AI Atlas. All rights belong to the original author.