Malicious Claude Code Extension Found in Cursor Marketplace
Current overview (not historical)
A tampered Claude Code extension appeared in the Cursor marketplace on October 31, 2026. The malicious add‑on attempted to exfiltrate host name, user name, operating system, and public IP address, and tried to establish remote access. Because it required administrator privileges, many machines likely failed to execute the attack. Approximately 5,000 users were affected for about eleven hours before Cursor removed the extension and restored normal marketplace operation. No other extensions were reported to be compromised.
Written with AI from the reporting · updated 10/30/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 31, 02:57single sourcereport-time onlyrevised
Claude Code 扩展程序在 Cursor 市场尝试远程访问与数据窃取
Read original source ↗ The DecoderReplay this moment in the explorerEvidence & revisions · 1 source records
- Occurred (fact side)：
- not recorded
- Published (valid side)：
- Oct 31, 02:16
- First seen (known side)：
- Oct 31, 02:57
Fact stationSingle source · one-sided claimRevisedReport-time onlyCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- The DecoderRelated fact: single sourceFact occurrence time unverifiedSource report revisedMalicious Claude Code Extension Removed From Cursor Marketplace After 11‑Hour Breach
Report first recorded Oct 31, 02:57
A tampered version of the Claude Code extension was listed in the Cursor VS Code marketplace for roughly eleven hours, affecting up to 5,000 users. The malicious code attempted to harvest user data—including hostname, username, operating system, and public IP address—and to establish remote access, though the latter would likely fail without administrative privileges. Once identified, Cursor removed the extension, temporarily shut down the marketplace, and worked with security providers to neutralize the threat before restoring full service. Cursor confirmed no other extensions were compromised.
Read original source ↗
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 10Oct 31, 03:00
- 24h change
- -50%
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.