{"$schema": "https://iptc.org/std/ninjs/ninjs-schema_3.2.json", "uri": "urn:newsml:wireva.mib.news:story:6005483a-4bd5-4e72-8873-ed2a9ec88c3e", "type": "composite", "version": "1", "versioncreated": "2026-10-30T19:30:19.906144Z", "firstcreated": "2026-10-30T19:30:19.906144Z", "pubstatus": "usable", "language": "en", "headline": "Tampered Claude Code Extension Sat in Cursor Marketplace for Eleven Hours", "description_text": "A tampered extension for Claude Code was accessible in the marketplace of the Cursor editor for about eleven hours. It attempted to steal user data and set up remote access. Cursor temporarily took the entire marketplace offline.", "associations": {"item-0": {"$schema": "https://iptc.org/std/ninjs/ninjs-schema_3.2.json", "uri": "urn:newsml:wireva.mib.news:item:f8859e78-655d-4940-a469-f70330d7ff50", "type": "text", "profile": "standard", "version": "1", "versioncreated": "2026-10-30T19:30:35.035459Z", "firstcreated": "2026-10-30T19:30:19.906144Z", "pubstatus": "usable", "urgency": 5, "language": "en", "headline": "Tampered Claude Code Extension Sat in Cursor Marketplace for Eleven Hours", "byline": "Jana Hartmann", "located": "Germany", "copyrightholder": "Haydamax OÜ", "copyrightnotice": "Wireva / Hochland", "usageterms": "Monitoring item. Headline, short extract and the source link may be shown. Do not republish the full text.", "description_text": "A tampered extension for Claude Code was accessible in the marketplace of the Cursor editor for about eleven hours. It attempted to steal user data and set up remote access. Cursor temporarily took the entire marketplace offline.", "altids": {"mosaic": "f8859e78-655d-4940-a469-f70330d7ff50", "story": "6005483a-4bd5-4e72-8873-ed2a9ec88c3e", "slug": "tampered-claude-code-extension-sat-in-cursor-marketplace-for-eleven-hours"}, "subject": [{"name": "Technology", "rel": "direct", "literal": "technology", "code": "medtop:13000000", "scheme": "http://cv.iptc.org/newscodes/mediatopic/", "uri": "http://cv.iptc.org/newscodes/mediatopic/13000000"}], "place": [{"name": "Germany", "literal": "de", "code": "DE", "scheme": "http://cv.iptc.org/newscodes/countrycodes/"}], "person": [], "organisation": [], "genre": [{"name": "Standard story", "literal": "standard"}], "service": [{"name": "Wireva", "literal": "wireva"}], "body_text": "A tampered extension for Claude Code was accessible in the marketplace of the Cursor editor for about eleven hours. It attempted to steal user data and set up remote access. Cursor temporarily took the entire marketplace offline.", "extra_body_note": "Extract only — see rights.class = link_only.", "associations": {"featuremedia": {"uri": "urn:newsml:wireva.mib.news:media:d995d892-83b3-4624-bb21-5fbbce54247c", "type": "picture", "version": "1", "pubstatus": "usable", "headline": "Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft", "description_text": "Tampered Claude Code Extension Sat in Cursor Marketplace for Eleven Hours", "copyrightholder": "en.wikipedia.org", "copyrightnotice": "Text editor", "usageterms": "File-level licence not yet resolved from Commons; fetch the original for exact terms.", "altids": {"wireva": "d995d892-83b3-4624-bb21-5fbbce54247c"}, "extra": {"wireva:delivery_mode": "preview_and_link", "wireva:rights": {"licence": "Wikimedia — licence per file", "licence_url": "https://commons.wikimedia.org/wiki/Commons:Reusing_content_outside_Wikimedia", "licence_raw": "Wikipedia page image", "licence_verified_at": "2026-10-30T19:30:35.062156Z", "attribution_required": true, "attribution_text": "Text editor", "redistribution_allowed": false, "commercial_use_allowed": false, "modifications_allowed": false, "share_alike_required": false}, "wireva:provenance": {"creator": "", "source_name": "en.wikipedia.org", "source_url": "https://en.wikipedia.org/wiki/Text_editor", "source_page_url": "https://en.wikipedia.org/wiki/Text_editor", "our_page_url": "https://hochland.uno/technology/tampered-claude-code-extension-sat-in-cursor-marketplace-for-eleven-hours/"}, "wireva:role": "lead"}, "renditions": {"preview": {"href": "https://nbg1.your-objectstorage.com/ckln/image-assets/d67ac5067590af03ffc4b6c3b237ef8344edc7d5d1727db41895cab24afdd7a7.jpg", "mimetype": "image/jpeg", "width": 1139, "height": 900}, "source": {"href": "https://en.wikipedia.org/wiki/Text_editor", "mimetype": "image/jpeg"}}}}, "extra": {"wireva:story": {"uri": "urn:newsml:wireva.mib.news:story:6005483a-4bd5-4e72-8873-ed2a9ec88c3e", "slug": "tampered-claude-code-extension-sat-in-cursor-marketplace-for-eleven-hours-20261030", "status": "developing", "languages": ["en"], "item_count": 1, "is_breaking": false}, "wireva:rights": {"class": "link_only", "redistribution_allowed": false, "commercial_use_allowed": false, "modifications_allowed": true, "share_alike_required": false, "attribution_required": true, "attribution_text": "Wireva / Hochland", "canonical_required": true, "canonical_url": "https://hochland.uno/technology/tampered-claude-code-extension-sat-in-cursor-marketplace-for-eleven-hours/", "linkback_required": true, "licence": "", "licence_url": "", "licensor": "Haydamax OÜ", "valid_until": null, "excerpt_max_chars": 280, "decided_by_rule": "derivation_failed", "needs_review": true}, "wireva:provenance": {"production_method": "automated", "ai_stages": {"editing": true, "drafting": true, "headline": true, "discovery": true, "classification": true, "image_selection": true, "source_collection": true, "cross_source_comparison": true}, "model": "", "human_reviewed": false, "reviewed_by": "", "reviewed_at": null, "editorial_control": true, "editorial_responsibility": "Haydamax OÜ (Wireva)", "factchecked": false, "verification_status": "single_source", "independent_confirmations": 0, "official_source_used": false, "used_press_release": false, "public_interest": false, "ai_disclosure_required": false, "ai_disclosure_text": "", "independence_check": {"status": "failed", "score": 0.595, "checked_at": "2026-10-30T19:30:35.058178Z"}, "sources": [{"url": "https://the-decoder.com/malicious-claude-code-extension-in-cursors-marketplace-attempted-remote-access-and-data-theft/", "title": "Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft", "publisher": "the-decoder.com", "type": "rss", "role": "primary", "official": false, "retrieved_at": "2026-10-30T19:30:35.044768Z", "published_at": "2026-10-30T17:16:10Z"}]}, "wireva:publication": {"name": "Hochland", "domain": "hochland.uno", "country": "DE", "url": "https://hochland.uno/technology/tampered-claude-code-extension-sat-in-cursor-marketplace-for-eleven-hours/"}, "wireva:links": {"self": "https://wireva.mib.news/api/v1/items/f8859e78-655d-4940-a469-f70330d7ff50", "html": "https://wireva.mib.news/item/f8859e78-655d-4940-a469-f70330d7ff50/tampered-claude-code-extension-sat-in-cursor-marketplace-for-eleven-hours/", "story": "https://wireva.mib.news/story/tampered-claude-code-extension-sat-in-cursor-marketplace-for-eleven-hours-20261030/"}, "wireva:metrics": {"word_count": 208, "char_count": 1361, "reading_time_seconds": 97}}}}, "extra": {"wireva:languages": ["en"], "wireva:status": "developing", "wireva:item_count": 1}}