Cursor 披露恶意 Claude Code VS Code 扩展安全事件
Cursor 识别出一起影响最多 5,000 名用户的安全事件，涉及其扩展市场提供的恶意修改版 Claude Code VS Code 扩展，该版本并非 Anthropic 开发。Cursor 已下架扩展市场、配合相关提供方清除恶意软件，并在确认无进一步风险后恢复市场；受影响用户可按博客指引排查恶意包并采取缓解措施，所有用户需更新至 Claude Code for VS Code 2.1.314。
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor.com/marketplace, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: cursor.com/blog/claude-code-…
来源：cursor_ai · x.com