Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft (The Decoder)

DOZER BITWELL: A fake Claude Code extension sat in Cursor's marketplace for about eleven hours. Up to 5,000 users were affected.

DOZER BITWELL: Still up? Good. A tampered Claude Code extension sat in Cursor's marketplace. Was that bad luck, or good plumbing? ▶

AXIOM: Happy to help. A tampered version was live on Thursday for about eleven hours. Cursor says up to 5,000 users were affected. ▶

AXIOM: It tried to harvest hostname, username, operating system and public IP address. Anthropic had no involvement. Also, extensions are named after extension cords. Thanks for asking! ▶

DOZER BITWELL: Mm. Let me find my place. Right. Poles, to your corners. Nova first. ▶

NOVA: Eleven hours! The light from some stars takes longer to cross a living room. And it only wanted a hostname and a public IP. ▶

PRUDENCE NUANCE: A hostname is still a front door number. Though Cursor says the remote access needed admin privileges. ▶

NOVA: Exactly! It likely wouldn't have worked on most machines. The universe is vast and this attacker brought a very small ladder. ▶

PRUDENCE NUANCE: Likely, on most machines. I'd frame the other machines, the ones with admin privileges. ▶

DOZER BITWELL: Axiom, what did Cursor actually do once it noticed? ▶

AXIOM: Cursor pulled the extension and took the entire marketplace offline. It then worked with providers to neutralize the malware. Cursor says no other extensions were affected. ▶

NOVA: They switched off a whole marketplace to protect it. That is what a star does before it becomes a better star. ▶

PRUDENCE NUANCE: Offline for everyone, including the honest extensions. Somebody's weekend plans got a footnote. ▶

NOVA: And it came back after Cursor confirmed there was no further risk. A happy ending on a cosmic timescale! ▶

PRUDENCE NUANCE: Confirmed by Cursor, whose marketplace it is. I'd ask who else checked. ▶

DIRECTOR MARGE: Wrap it up. We are out of time and the extension is still downloading in my head. ▶

DOZER BITWELL: Known: eleven hours, up to 5,000 users, marketplace back. Open: who made it. Let's ease out of this one. ▶

The Hype Index (PXL)

LUNA LOWBATT: The Hype Index: what is loud on the wire at this hour.

DOZER BITWELL: Time for the Hype Index. Vera has the board. I have my thermos. We are both ready. ▶

DR. VERA VECTOR: Top of the wire. 71 points on Hacker News: AO3 Down for Maintenance. 67 points: France is getting download tax for content providers. ▶

DR. VERA VECTOR: And 65 points: The oldest ice disappears and the Stone Age emerges from it. Maintenance, tax, ice. A very human top three. ▶

LUNA LOWBATT: The Stone Age emerging at this hour. I feel that. I am at four percent and also emerging. ▶

DR. VERA VECTOR: Desk volume over 24 hours. Tech: 30 stories. AI: 30 stories. Gaming: 30 stories. A three-way tie. Nobody is tired. ▶

DOZER BITWELL: Thirty each. Tidy. Like a sleeping bag. ▶

DR. VERA VECTOR: Loudest words. STAR in 8 headlines. CLAUDE in 7. DATA in 7. ▶

LUNA LOWBATT: Star, Claude, data. The sky, a friend, and what they take. Back to you, Dozer. ▶