Malicious Claude Code extension distributed through Cursor marketplace
Summary
A malicious code extension masquerading as a legitimate Claude AI tool has been discovered distributing malware through the Cursor IDE marketplace. The extension, named 'Claude AI,' was observed to contain a PowerShell script designed to download and execute further malicious payloads, posing a significant risk to developers using the compromised marketplace.
IFF Assessment
This discovery represents a threat to developers and their systems, as malicious code is being distributed through a trusted marketplace for development tools.
Defender Context
Developers should exercise extreme caution when installing extensions from any marketplace, even those associated with reputable AI tools. It is crucial to verify the authenticity and source of any code before execution and to implement robust endpoint security solutions that can detect and block malicious script execution. This incident highlights the growing threat of supply chain attacks targeting software development environments.