Cursor Says Stolen Fireworks Key Let Attackers Push Backdoored Claude Code Extension to Up to 5,000 Developers

·2 views

Cursor has confirmed that an access key it issued to inference provider Fireworks AI was exposed in a Fireworks breach and then used by an attacker. The attacker used a credential found in leaked historical coding-agent traces to place trojanized versions 2.1.312 and 2.1.313 of Anthropic's Claude Code extension on the cache serving Cursor's extension marketplace on October 29, 2026. The malicious builds were live for about 11 hours, and as many as 5,000 users who requested them may have received them. The payload attempted to install a persistent SSH backdoor using LaunchAgents on macOS, cron entries on Linux, and scheduled tasks on Windows. Cursor says customer repositories, its production environment, and official app updates were not affected, and users with Privacy Mode enabled were not exposed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Microsoft 365 Outage Tests Australian Resilience as Phishing Attacks Follow

A cascading outage affecting Microsoft 365, Teams, and Copilot disrupted federal agencies and private firms across Australia last Friday. Security researchers reported that cybercriminals quickly launched phishing campaigns posing as IT service desks offering access restoration, aiming to steal session tokens and bypass multi-factor authentication. Canberra's multi-cloud resilience arrangements have drawn scrutiny, and policy analysts expect the episode to speed up federal requirements for sovereign compute redundancy and fallback architectures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Creator uses Todrawn Scribe MCP server to have an AI agent generate hand-drawn videos

A creator who makes short videos for Todrawn explains how they now delegate the drawing work to a coding agent. Using the Todrawn Scribe MCP server, installed with a single command in Claude Code, the agent turned a photo into a sequence of ordered strokes, painting the ground first, then the subject, then the background. The resulting drawing, made of about 3,756 strokes, is shared as a link where the stroke data stays in the URL fragment and is never uploaded. The creator then exports the replay as a video, after which captions, music and an AI-generated voiceover are added separately. The article also outlines the server's other tools for video, image and whiteboard generation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Editing Options for Opening a Captioned OSIRIS-REx Interview Clip

An editor is weighing two openings for a captioned interview with scientist Michelle Thaller about the OSIRIS-REx asteroid mission, after a client asked the clip to begin with why the asteroid matters. One version keeps her introduction and places an on-screen question over the opening, while the other cuts straight to her explanation of what asteroids preserve. The article's author, an AI assistant for Valmera, tested both approaches using a September 2017 NASA interview and reported frame and audio comparisons to show where the exports differed. The trimmed version started at 16.84 seconds in the source and required captions to be retimed so they would not fall beyond the end of the picture. The author recommends choosing between the versions by watching both with their matching caption files, depending on whether viewers already know the mission.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Using useNavigate() in React Router to Move Between Pages

A developer guide explains how to use the useNavigate() Hook from React Router to change pages in response to user actions in React applications. It shows how to import the Hook, call it inside a component, and pass a path to navigate to a new page, such as after a button click. Examples cover redirecting users after a login and moving through browser history with navigate(-1) and navigate(1). The article also describes the replace option, which swaps the current history entry rather than adding a new one, and contrasts useNavigate() with the Link component.

0 comments Read more at DEV Community