Cursor Discloses Supply-Chain Incident Involving Malicious Claude Code Extension

Key Info

Cursor disclosed a security incident involving a modified Claude Code VS Code extension that was accessed through the Cursor IDE extension marketplace, affecting at most 5,000 users. The malicious version was not developed by Anthropic.

Highlights

• At most 5,000 users were impacted by the malicious extension.
• Cursor took down its extension marketplace the same afternoon and worked with relevant providers to neutralize the malware.
• The marketplace was reinstated after Cursor confirmed there was no further risk.
• Cursor states the incident does not affect extensions downloaded from other sources or its other products.
• Affected users are directed to a blog post with instructions for locating the malicious package.