Skip to content
NewsIncident

Malicious Claude Code extension in Cursor's marketplace stole data from up to 5,000 users

· by Pondero Newsdesk

The short version

A tampered Claude Code extension sat live in Cursor's marketplace for about 11 hours on October 30, 2026, harvesting hostnames and IP addresses from up to 5,000 installs before Cursor pulled the whole marketplace offline.

Malicious Claude Code extension in Cursor's marketplace stole data from up to 5,000 users

A tampered copy of the Claude Code extension sat live in Cursor's VS Code-based marketplace for about 11 hours on October 30, 2026, long enough for as many as 5,000 users to install something that was never built by Anthropic, per Cursor's own statement, as reported by The Decoder.

What

Cursor said a modified version of the Claude Code extension reached its marketplace on Thursday, October 30, 2026, and stayed available for roughly 11 hours before the company caught it, according to Cursor's statement and The Decoder's report. Up to 5,000 users may have installed the fake package. Once running, it collected the host machine's hostname, username, operating system, and public IP address, and it tried to open remote access for whoever controlled it, an attempt Cursor said would likely have failed on most machines because it required admin-level privileges it did not have. Cursor pulled the extension and took the entire marketplace offline rather than leave the rest of the catalog reachable while it investigated. After working with unnamed providers to neutralize the malware and confirming no other listed extension carried the same code, Cursor brought the marketplace back online. Anthropic had no role in building the extension; the malicious package only borrowed Claude Code's name and reputation to get installs.

The real Claude Code extension is one of the most-installed items in Cursor's marketplace, since it lets developers run Anthropic's coding agent inside the editor instead of a separate terminal window. That popularity is exactly what made it a useful name to impersonate: a listing titled "Claude Code" does not need a convincing description or fake reviews to look legitimate, it just needs to sit near the top of search results for a name developers already trust. Cursor has not said how the fake listing got past the marketplace's initial review, whether that review is automated, manual, or some mix of both, or how many separate uploads it took before the malicious version went live.

Affected users need to rotate exposed credentials, not just update the extension

Anyone who installed the fake extension between its upload and Cursor's takedown should treat the machine as having leaked its hostname, username, OS version, and public IP to an outside party, regardless of whether the remote-access attempt actually succeeded. Those four data points are enough to fingerprint a specific developer's machine and target follow-up phishing or social-engineering attempts, even without admin access. The practical fix is not just removing the extension: anyone unsure whether they installed it in that window should check their Cursor marketplace install history, rotate any credentials or SSH keys stored on that machine, and watch for unfamiliar login attempts tied to the leaked IP. Cursor's decision to take the whole marketplace down, rather than quietly remove one listing, suggests the company could not immediately rule out the extension having piggybacked on other packages, a conservative call that cost availability but limited how long a compromised install could sit unnoticed next to unaffected extensions.

The admin-privilege requirement did real work here. A remote-access attempt that needs elevated permissions fails on the default configuration of most developer laptops, where the logged-in account runs without admin rights for day-to-day work. That gap between what the extension tried to do and what it could actually pull off on a typical machine is the difference between a data-collection incident and a full remote-takeover incident. It is not a reason to skip the cleanup steps above, since the data-harvesting portion ran regardless of privilege level, but it explains why Cursor's statement frames the remote-access piece as unlikely to have succeeded rather than as a confirmed breach.

Context and reactions

Marketplace poisoning aimed at AI coding tools is not new. A threat actor tracked as WhiteCobra planted 24 malicious extensions across the Visual Studio Marketplace and the Open VSX registry targeting VS Code, Cursor, and Windsurf users starting in 2025, per BleepingComputer's reporting at the time, with one fake Solidity extension racking up 54,000 downloads before it was caught. That campaign targeted cryptocurrency wallets rather than developer-machine metadata, but it established the same pattern this incident follows: attackers impersonate a trusted, well-known tool name to get past a marketplace's review process, then harvest whatever the install step allows. Cursor has not said whether the uploader behind the fake Claude Code extension is connected to any previously identified group.

What to watch next

Whether Cursor publishes a dedicated post-incident writeup with remediation steps beyond its initial statement, and whether other AI-coding marketplaces, including Open VSX directly, Windsurf, and Antigravity, disclose similar namespace-squatting attempts in the same window. A single caught incident rarely means a campaign is over; it usually means one listing got noticed before the next one went up.

Sources