Malicious Code in Cursor Extension Affects Up to 5,000 Users

A maliciously tampered Claude Code extension was published on the AI code editor "Cursor"'s marketplace, affecting up to 5,000 users. The extension existed on the marketplace for approximately 11 hours and attempted to steal user data and establish remote access. After confirming the issue, Cursor temporarily closed its entire marketplace.

Cursor is a code editor that features AI-powered code completion and editing assistance, and its use is expanding among developers. The marketplace serves as an official distribution platform for extending its functionality, where users can install various extensions under the presumption of relative safety. The problematic package appears to have been a tampered counterfeit that mimicked "Claude Code," an extension designed to work with Anthropic's AI assistant "Claude."

The extension's attempted operations fell into two main categories. One was data theft, transmitting user data externally; the other was establishing remote access, allowing attackers to operate the terminal from a distance. If either had succeeded, there was a risk that developers' work environments and confidential information could have been exposed. After becoming aware of the situation, Cursor temporarily took its entire marketplace offline and later reopened it once safety was confirmed.

This attack methodology is called "supply chain attack." It involves disguising malicious code as legitimate software or distribution channels, with the characteristic feature of targeting package managers and extension stores that users trust. Developer tools are susceptible to being valuable targets for attackers since they handle substantial amounts of confidential information.

Notable in this case is that the platform took action before actual harm materialized. However, the 11-hour exposure period was hardly brief, and it is undeniable that users who installed the extension during that window may have been unknowingly exposed to risk. While Cursor's decision to reopen its marketplace after safety verification represents swift action, the fact that malicious extensions continued to be published before detection raises questions about the nature of pre-approval review systems.

As the use of AI development tools rapidly expands, the security of its surrounding ecosystem, particularly extensions and plugins, is being questioned anew. From a user perspective, cultivating the habit of carefully verifying the source provider, publication date, review count, and other details when installing extensions can help mitigate risk. From the platform's perspective, there are views that strengthening pre-release review processes and implementing mechanisms to detect abnormal communications are necessary.