Cursor Shuts Down Marketplace After Malicious Claude Code Extension Affects Users

Coding platform Cursor temporarily shut down its extension marketplace following the discovery of a malicious Claude Code extension that reportedly affected up to 5,000 users. According to the company, the extension was not developed by Anthropic and attempted to collect user data and establish remote access.

Cursor stated that the incident was identified on October 29. The company reported that the malicious extension executed code attempting to install a backdoor, gather system information such as IP addresses and usernames, and add an attacker-controlled SSH key. Cursor reported that it took down the marketplace on Friday, worked with relevant providers to neutralize the malware, and restored the service shortly after following security audits and key rotations.

Key Details of the Incident

• Impact: Up to 5,000 users affected; Cursor stated it would contact impacted individuals directly.
• Behavior: The extension attempted to collect user data and run every 60 seconds, according to company disclosures.
• Scope: Cursor confirmed that other extensions in its marketplace and other SpaceX products were not affected.

Practical Implications and Verification

Users of the platform are advised to update their Claude Code extension following instructions issued by Cursor on official channels such as X. To verify announcements, check official Cursor blog posts and security updates directly rather than relying on unverified third-party links.