Anthropic Claude 插件遭供应链攻击植入后门The DecoderT2·开发与工程

Cursor 市场遭投毒 Claude Code 扩展窃取数据

作者：Matthias Bastian原标题：Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft

68AI 研判分

Cursor 扩展市场出现被篡改的 Claude Code 插件，尝试窃取用户主机名、IP 等敏感信息并建立远程访问通道。该恶意插件在线约 11 小时，影响近 5000 名用户，目前已被下架且市场恢复正常运行。

报道正文

Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft

文本

  [Matthias Bastian](https://the-decoder.com/author/matthias-bastian/) [View the LinkedIn Profile of Matthias Bastian](https://www.linkedin.com/in/matthias-bastian-128b71b1/)   Oct 30, 2026

Heads up if you recently installed the Claude Code extension for Cursor. A tampered version was available in the Cursor VS Code extension marketplace on Thursday for about eleven hours, affecting up to 5,000 users, according to the company. Anthropic had no involvement in developing it.

The extension tried to harvest user data like hostname, username, operating system, and public IP address. It also attempted to set up remote access for the attacker, though that likely wouldn't have worked on most machines since it requires admin privileges, Cursor says. Once discovered, Cursor pulled the extension and took the entire marketplace offline. After working with providers to neutralize the malware and confirming there was no further risk, the marketplace was reinstated. Cursor says no other extensions were affected.

Cursor AdAd