Tampered Claude Code extension in Cursor marketplace attempted data theft and remote access
A tampered version of the Claude Code extension was available in Cursor's VS Code extension marketplace for about eleven hours, potentially affecting up to 5,000 users, Cursor says. The extension attempted to harvest hostname, username, OS and public IP and tried to set up remote access (which likely would have failed on most machines without admin rights); Cursor removed the extension, took the marketplace offline, worked with providers to neutralize the malware, and later reinstated the marketplace; Anthropic was not involved.