Up to around 5,000 people may have been affected. Is it still safe to install extensions casually?
Cursor says attackers obtained a key leaked by Fireworks and, on October 29, distributed malicious copies of Claude Code, versions 2.1.312 and 2.1.313, through Cursor’s VS Code extension marketplace cache.
The two versions were available for around 11 hours before being removed. Cursor says the vast majority of users were unaffected, and up to around 5,000 users may have been affected. Affected users have been notified directly.
Here’s what matters to you: your development machine. If you use AI coding tools to write smart contracts or run scripts, and your machine has exchange API keys, wallet private keys, or seed phrases on it, assume they may have been exposed. Don’t take the risk.
1️⃣ Check your extension list for versions 2.1.312 and 2.1.313 2️⃣ If you installed one, remove it 3️⃣ Rotate any relevant keys used on that development machine.
Have you installed the Claude Code extension? What version? Compare notes in the comments. #Cursor
Cursor says attackers obtained a key leaked by Fireworks and, on October 29, distributed malicious copies of Claude Code, versions 2.1.312 and 2.1.313, through Cursor’s VS Code extension marketplace cache.
The two versions were available for around 11 hours before being removed. Cursor says the vast majority of users were unaffected, and up to around 5,000 users may have been affected. Affected users have been notified directly.
Here’s what matters to you: your development machine. If you use AI coding tools to write smart contracts or run scripts, and your machine has exchange API keys, wallet private keys, or seed phrases on it, assume they may have been exposed. Don’t take the risk.
1️⃣ Check your extension list for versions 2.1.312 and 2.1.313 2️⃣ If you installed one, remove it 3️⃣ Rotate any relevant keys used on that development machine.
Have you installed the Claude Code extension? What version? Compare notes in the comments. #Cursor
