NEWS · CODING · #2844
Tampered Claude Code extension in Cursor marketplace attempted data theft and remote access
A tampered version of the Claude Code extension was available in Cursor's VS Code extension marketplace for about eleven hours, potentially affecting up to 5,000 users, Cursor says. The extension attempted to harvest hostname, username, OS and public IP and tried to set up remote access (which likely would have failed on most machines without admin rights); Cursor removed the extension, took the marketplace offline, worked with providers to neutralize the malware, and later reinstated the marketplace; Anthropic was not involved.
KEY POINTS
- A tampered version of the Claude Code extension was available in Cursor's VS Code extension marketplace for about eleven hours, potentially affecting up to 5,000 users, Cursor says.
- The extension attempted to harvest hostname, username, OS and public IP and tried to set up remote access (which likely would have failed on most machines without admin rights); Cursor removed the extension, took the marketplace offline, worked with providers to neutralize the malware, and later reinstated the marketplace; Anthropic was not involved.
- Malicious or tampered AI-related extensions in code-editor marketplaces are a supply-chain risk that can expose developer machines and data, undermining trust in AI tooling and extension ecosystems.
WHY IT MATTERS
Malicious or tampered AI-related extensions in code-editor marketplaces are a supply-chain risk that can expose developer machines and data, undermining trust in AI tooling and extension ecosystems.