Tampered Claude Code extension appears in Cursor extension marketplace, affecting up to 5,000 users
Cursor said that a tampered Claude Code VS Code extension appeared in its IDE extension marketplace, affecting up to 5,000 users; the malicious version was not developed by Anthropic. Cursor took down the extension marketplace the same day, worked with relevant service providers to remove the malware, and after confirming there was no further risk, restored it online and required all users to upgrade to Claude Code for VS Code version 2.1.314.
Why read this
SelectedAI score 60
Cursor officially disclosed that a tampered Claude Code extension appeared in its extension marketplace, and provided the scope of impact and the handling process, which can serve as a reference for those concerned about IDE plugin supply chain risks.
Topics
Body
We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users. This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the https://t.co/sJRGX5jLXW, Grok Bot, Grok or our other SpaceXSI products.
In response, we took down our extension marketplace this afternoon, worked with relevant providers to neutralize the malware, and have reinstated the marketplace after confirming there is no further risk.
If affected, please review instructions in this blog post to understand how to find the malicious package and establish a path to mitigate any potential impact. We are asking all customers update to Claude Code for VS Code version 2.1.314: https://t.co/ESqf7YEtHZ