Malicious version of Claude Code discovered on Cursor marketplace
A malicious version of the Claude Code extension has been identified on the Cursor extension marketplace. The compromised versions contained backdoors designed to exfiltrate data from developers' machines.
What happened?
A malicious version of the Claude Code extension (Anthropic.claude-code versions 2.1.312 and 2.1.313) was detected on the Cursor code editor marketplace. The manipulated versions targeted Windows and MacOS systems and contained code engineered to harvest information from infected machines. The incident led to the prompt removal of the extension from the Cursor store.
Key facts
| Påverkade versioner | 2.1.312 och 2.1.313 |
|---|---|
| Berörda operativsystem | Windows och MacOS |
| Drabbad plattform | Cursor Extension Marketplace |
Why it matters
The attack highlights vulnerabilities in the software supply chain surrounding developer tools and extensions. As developers increasingly rely on AI assistants, compromised extensions can provide attackers with direct access to development environments, credentials, and proprietary source code.
Who is affected?
Developers and engineers using Cursor who installed the affected versions of Claude Code are directly impacted. Organisations whose programmers work with sensitive source code or store API keys locally are also affected from a security perspective.
Impact on the EU
The incident potentially affects developers within the EU who downloaded the extension via the Cursor marketplace. Development teams within the union are advised to conduct an inventory of their development environments and rotate API keys to prevent data leakage.
What else you should know
Cursor removed the malicious versions from its marketplace following the discovery of the incident. The team behind Cursor has published a security advisory recommending that affected users delete the extension and conduct a system review.
Quick answers about this story
Vad har hänt?
När hände det?
Varför spelar det roll?
Vad bör drabbade utvecklare göra?
The link opens in a new window and leads to the publisher's own site.
Källan har spårats automatiskt från utgivaren via Aheadlines signalkedja.
Get similar news straight to your inbox
The reader's room
Send in a question or an addition. The newsroom reads everything before it's published and replies when relevant. No AI-generated text – just people.
Sign in to submit a comment or question.
Read the article through your role
- Decide whether this affects strategy over 6–12 months or is just noise.
- Discuss with leadership: do we own the right question or does ownership need to move?
- Ask: what risk are we taking by NOT acting on this this quarter?
Generated angle — not editorial analysis of "Malicious version of Claude Code discovered on Cursor market"