Unverified50% confidenceFactExact time
When a maintainer's account is compromised, attackers may plant malicious code in the project and distribute it to all downstream users through subsequent updates.
1
Sources
50%
Confidence
Long-term
Relevance
9/12/2026
First Seen
Sources
Related Entities
Related Claims
Unverified攻击者获取refresh_token后即可持续刷新获得新访问权限，即便用户修改密码，已泄露Token在过期前仍可被持续滥用，这称为会话劫持76% similarUnverifiedCentralized management of account credentials creates a single point of failure risk; once the third-party recharger's system is compromised, all users' code data will be exposed to leakage.74% similarUnverifiedDuring installation, the Kuaima client needs to modify system network configurations and Cursor's internal files, and such behavior is easily flagged as malicious by the active defense mechanisms of security software69% similarUnverifiedDependency confusion attacks exploit the characteristic of package managers to check public sources first when resolving dependencies, allowing attackers to register package names used internally by enterprises in order to trick build systems into downloading malicious code.68% similarUnverifiedQR code access carries security risks including replay attacks, session credential leakage due to long-lived tokens, and man-in-the-middle attacks.68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/913688API
curl https://kongchang.com/api/v1/knowledge/claims/913688MCP
get_claim(id=913688)