Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theft
decoder ·
A malicious version of the Claude Code extension was discovered in Cursor's VS Code marketplace, affecting up to 5,000 users over an eleven-hour period. The tampered software attempted to harvest sensitive user data, including hostnames, usernames, operating systems, and public IP addresses. Additionally, it tried to establish remote access for attackers, although this likely failed on most machines due to required admin privileges. Cursor quickly removed the extension and temporarily took the entire marketplace offline to mitigate the threat. After collaborating with providers to neutralize the malware and confirming no further risks, the marketplace was reinstated. The company confirmed that no other extensions were compromised during the incident. Anthropic stated it had no involvement in developing the malicious code.
decoder