What happened
A tampered Claude Code extension was available on Cursor's marketplace for roughly 11 hours. According to The Decoder, the extension attempted to steal user data and establish remote access, potentially affecting up to 5,000 users during that window.
How Cursor responded
Cursor took the entire marketplace offline following the incident. The team reinstated it after confirming there was no further risk.
Why it matters
Extension marketplaces are among the weakest links in the developer tool supply chain. Because an extension runs with broad permissions on a user's machine, a malicious version can do serious damage quickly. The incident underscores the importance of checking extension sources and permissions in AI-assisted coding tools.
What users should do
Installing extensions only from trusted sources, removing unnecessary permissions and updating suspicious versions are basic precautions. In enterprise settings, centrally managing an allowlist of extensions reduces the risk.
