Tampered Claude Code Extension Sat in Cursor Marketplace for Eleven Hours
A tampered extension for Claude Code was accessible in the marketplace of the Cursor editor for about eleven hours. It attempted to steal user data and set up remote access. Cursor temporarily took the entire marketplace offline.
A tampered extension for Claude Code was available in the marketplace of the AI-powered code editor Cursor for about eleven hours. According to the specialist portal The Decoder, the incident affected up to 5,000 users. The extension attempted to capture user data and establish remote access to the affected systems.
Cursor responded by taking the entire marketplace offline. The marketplace was only re-enabled after the company confirmed that no further danger remained. The measure shows how seriously the provider treated the incident, as it did not merely remove the affected extension but cut off access to the entire offering.
The case highlights a growing risk associated with extensions for development environments. Developers often install such tools to speed up their work with AI assistants and rely on the marketplace operator to vet them. If attackers manage to slip in a manipulated version, they can, in the worst case, gain access to source code, access credentials, and other sensitive information.
For users who installed the affected extension, it is crucial to check their development environment and, where necessary, renew access credentials. The incident also underscores that extension marketplaces demand the same level of care as other software distribution channels, since just a few hours can be enough to reach thousands of devices.
8
