Cursor says around 5,000 people may have installed a malicious Claude Code extension.
The SpaceX-owned AI coding tool says the modified version of Claude Code appeared on its extension marketplace from 5:27AM ET and 4:35PM ET on Thursday. The extension contains malicious code that collects various information, including hostname, username, operating system, home directory path, public IP address, and more.
TL;DR
- A malicious version of the Claude Code extension was available on the Cursor marketplace.
- The extension was active on Thursday between 5:27 AM ET and 4:35 PM ET.
- It contained malicious code designed to collect user information like hostname, username, OS, home directory path, and public IP address.
- Cursor has removed the malicious extension and verified the security of other extensions.