Cursor pulls malicious Claude Code extension from marketplace, up to 5,000 users affected
SumitGup · x · 2026-10-30
Cursor confirmed a supply-chain security incident: a tampered, malicious version of the Claude Code VS Code extension (not built by Anthropic) was slipped into the Cursor IDE extension marketplace, potentially giving attackers access to the machines of developers who installed it. At most 5,000 users were affected.
Cursor took its marketplace offline the same afternoon, worked with the relevant provider to neutralize the malware, and restored the marketplace after confirming no further risk. It published a blog post with instructions for finding the malicious package and securing affected systems. Commenters note affected users still need to harden their machines.
More from coding & agent
- effect-harness on Cloudflare: run agent loops, tools and credentials on separate VMs — samgoodwin89 · 2026-10-31
- jh3yy: agents gave me flow state — my tools finally keep up with my brain — jh3yy · 2026-10-31
- CAFE ecosystem: Maple moves 300k lines of React to Foldkit in 3 days — samgoodwin89 · 2026-10-31
- Non-coder builds 100-star Android TV launcher entirely with Claude — SuB8u · 2026-10-31
- Liquid AI ships LFM2.5-24B LoRA adapters for Pi and Claude Code, cutting tool calls 40% — yb2698 · 2026-10-31
- Factory acquires typedef_ai to give coding agents an enterprise data context layer — maddiehfaulkner · 2026-10-31