Skip to content

Back to the catalog

Shubham Mishra 🐐 (@shubh6200) on X
x.comthread

Shubham Mishra 🐐 (@shubh6200) on X

A post relaying Cursor's security advisory: a modified, malicious Claude Code VS Code extension was distributed through the Cursor extension marketplace, affecting at most 5,000 users. Anthropic did not develop that version, and other extensions are not affected. Users of Claude Code in Cursor are told to update to version 2.1.314. The post adds that marketplaces need publisher verification and package integrity checks. It gives no technical detail on the payload.

TL;DR Cursor disclosed a trojanized Claude Code extension on its marketplace hitting up to 5,000 users; update to 2.1.314.
Open original ↗

Organisations named here

  • Anthropic
  • Cursor

Technologies named here

  • Cursor
  • Claude Code
  • VS Code
  • Claude Code VS Code extension (modified, malicious version, accessed through the Cursor extension marketplace)
  • Cursor IDE extension marketplace

Techniques named here

  • Software supply chain attacks

Concepts named here

  • Continuous security monitoring
  • Package integrity checks
  • Publisher verification
  • Software supply chain security

Related in Supply Chain