Cursor市场恶意Claude Code分机试图远程访问和数据盗窃

Cursor市场恶意Claude Code分机试图远程访问和数据盗窃

如果您最近为 Cursor 安装了 Claude Code 扩展名，请注意。 据该公司称，星期四在Cursor VS代码扩展市场可使用一个被篡改的版本，时间约为11小时，影响到多达5 000个用户。 Anthropic没有参与开发。

该扩展试图收取用户数据，如主机名，用户名，操作系统，以及公共IP地址等。 它还试图为攻击者设置远程访问，尽管由于需要管理员权限Cursor 称，这很可能不会在大多数机器上起作用。 发现后，Cursor拉开延伸口，将整个市场下线。 在与供应商合作消除恶意软件并确认不再有风险后，市场被恢复。 Cursor 称没有其他扩展受到影响。

AI News Without the Hype – 由人类治愈

订阅THE DECODER免费阅读，每周AI通讯，我们独家的"AI雷达"前沿报告每年6次，全面存档访问，访问我们的评论部分。

现在订阅

本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft

Heads up if you recently installed the Claude Code extension for Cursor. A tampered version was available in the Cursor VS Code extension marketplace on Thursday for about eleven hours, affecting up to 5,000 users, according to the company. Anthropic had no involvement in developing it.

The extension tried to harvest user data like hostname, username, operating system, and public IP address. It also attempted to set up remote access for the attacker, though that likely wouldn't have worked on most machines since it requires admin privileges, Cursor says. Once discovered, Cursor pulled the extension and took the entire marketplace offline. After working with providers to neutralize the malware and confirming there was no further risk, the marketplace was reinstated. Cursor says no other extensions were affected.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now

Auto-fetched and translated by AI Gem Box. All rights belong to the original author.