Malicious Claude Code Extension Removed From Cursor Marketplace After 11‑Hour Breach

A tampered version of the Claude Code extension was listed in the Cursor VS Code marketplace for roughly eleven hours, affecting up to 5,000 users. The malicious code attempted to harvest user data—including hostname, username, operating system, and public IP address—and to establish remote access, though the latter would likely fail without administrative privileges. Once identified, Cursor removed the extension, temporarily shut down the marketplace, and worked with security providers to neutralize the threat before restoring full service. Cursor confirmed no other extensions were compromised.