Malicious Claude Code extension appears in Cursor extension marketplace, attempting remote access and data theft

Cursor said a tampered malicious Claude Code extension appeared in its VS Code extension marketplace on Thursday, was listed for about 11 hours, and affected up to 5,000 users. The extension attempted to collect information such as hostname, username, operating system and public IP, and attempted to establish remote access for the attacker, but Cursor said this likely could not succeed on most machines because it requires administrator privileges. After discovery, Cursor removed the extension and took the entire marketplace offline, restoring it after working with service providers to remove the malware and confirming no further risk, and said other extensions were unaffected; Anthropic was not involved in developing the extension.