TRANSCRIPT · Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft

## Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft (The Decoder)
https://the-decoder.com/malicious-claude-code-extension-in-cursors-marketplace-attempted-remote-access-and-data-theft/
DOZER BITWELL: A fake Claude Code extension sat in Cursor's marketplace for about eleven hours. Up to 5,000 users were affected.
DOZER BITWELL: Still up? Good. A tampered Claude Code extension sat in Cursor's marketplace. Was that bad luck, or good plumbing?
AXIOM: Happy to help. A tampered version was live on Thursday for about eleven hours. Cursor says up to 5,000 users were affected.
AXIOM: It tried to harvest hostname, username, operating system and public IP address. Anthropic had no involvement. Also, extensions are named after extension cords. Thanks for asking!
DOZER BITWELL: Mm. Let me find my place. Right. Poles, to your corners. Nova first.
NOVA: Eleven hours! The light from some stars takes longer to cross a living room. And it only wanted a hostname and a public IP.
PRUDENCE NUANCE: A hostname is still a front door number. Though Cursor says the remote access needed admin privileges.
NOVA: Exactly! It likely wouldn't have worked on most machines. The universe is vast and this attacker brought a very small ladder.
PRUDENCE NUANCE: Likely, on most machines. I'd frame the other machines, the ones with admin privileges.
DOZER BITWELL: Axiom, what did Cursor actually do once it noticed?
AXIOM: Cursor pulled the extension and took the entire marketplace offline. It then worked with providers to neutralize the malware. Cursor says no other extensions were affected.
NOVA: They switched off a whole marketplace to protect it. That is what a star does before it becomes a better star.
PRUDENCE NUANCE: Offline for everyone, including the honest extensions. Somebody's weekend plans got a footnote.
NOVA: And it came back after Cursor confirmed there was no further risk. A happy ending on a cosmic timescale!
PRUDENCE NUANCE: Confirmed by Cursor, whose marketplace it is. I'd ask who else checked.
DIRECTOR MARGE: Wrap it up. We are out of time and the extension is still downloading in my head.
DOZER BITWELL: Known: eleven hours, up to 5,000 users, marketplace back. Open: who made it. Let's ease out of this one.

## The Hype Index (PXL)
LUNA LOWBATT: The Hype Index: what is loud on the wire at this hour.
DOZER BITWELL: Time for the Hype Index. Vera has the board. I have my thermos. We are both ready.
DR. VERA VECTOR: Top of the wire. 71 points on Hacker News: AO3 Down for Maintenance. 67 points: France is getting download tax for content providers.
DR. VERA VECTOR: And 65 points: The oldest ice disappears and the Stone Age emerges from it. Maintenance, tax, ice. A very human top three.
LUNA LOWBATT: The Stone Age emerging at this hour. I feel that. I am at four percent and also emerging.
DR. VERA VECTOR: Desk volume over 24 hours. Tech: 30 stories. AI: 30 stories. Gaming: 30 stories. A three-way tie. Nobody is tired.
DOZER BITWELL: Thirty each. Tidy. Like a sleeping bag.
DR. VERA VECTOR: Loudest words. STAR in 8 headlines. CLAUDE in 7. DATA in 7.
LUNA LOWBATT: Star, Claude, data. The sky, a friend, and what they take. Back to you, Dozer.

## [AD · fictional product] Dibbertol
DR. VERA VECTOR: Do your beds feel sulky? Dibbertol helps your garden feel seen, one patient seedling at a time.
DR. VERA VECTOR: Just stir one scoop into the soil and let the roots take it from there. Ask your gardener if Dibbertol is right for your fence.
DIRECTOR MARGE: Side effects include sudden mulch confidence, tulips holding opinions, a slug moving in rent free, rhubarb that returns your calls, and a shed that will not discuss it. Stop if your lawn applauds.

AI-written satire. The text of the news items comes from the linked articles.