Malicious Claude Code Extension Served in Cursor Supply Chain Attack
Teaser from the source
The extension performed host reconnaissance and attempted to create a reverse SSH tunnel. The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek .
This is the RSS-feed teaser. Read the full article at the original source.
Read at SecurityWeekMore on Malicious
Other advisories
- Criticalghsa:GHSA-vghh-5rfx-xhq8LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image
- Criticalghsa:GHSA-jpf8-86f3-wp38LXD has arbitrary file read+write on host via templates/ symlink in malicious image
- CriticalCVE-2026-48755LXD host escapes via malicious images, backup compression, and project-restriction bypasses (GHSA-jpf8 / GHSA-9j25 / GHSA-vghh / GHSA-pjff / GHSA-fmc8 / GHSA-47w9 / GHSA-7mr3 / GHSA-qx75)
- Highosv:MAL-2026-18657Malicious code in strands-aidr (PyPI)
- Highosv:MAL-2026-18651Malicious code in @secauditb20y/sec-test-b1 (npm)
- Highosv:MAL-2026-18650Malicious code in @secaudita10x/sec-test-a1 (npm)
- Highosv:MAL-2026-18653Malicious code in dogmans-afterglow (npm)
- Highosv:MAL-2026-18656Malicious code in thththtbhthhth (npm)
Other news entries
- Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' ComputersNewsThe Hacker News
- CPython flaw exposes AI inference servers to sandbox escape attacksNewsCSO Online
- Email threat landscape: Q3 2026 trends and insightsNewsMicrosoft Threat Intelligence
- GhostMap Android flaw lets malicious app trigger persistent boot loopNewsBleepingComputer
- The Sandbox Fights Back: Joe Security Launches Adaptive DetonationNewsCSO Online
- Attackers turned OpsShield’s trusted update channel into a supply-chain attackNewsCSO Online
- Google Calendar phishing campaign hijacks sessions, bypasses MFANewsBleepingComputer
- Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's MemoryNewsThe Hacker News
Source: https://www.securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack/
ID