A malicious extension disguised as Claude Code was found in Cursor’s extension marketplace. It attempted to gain remote access to victim machines and steal sensitive data. Cursor removed the extension after security researchers flagged it. Users who installed it face potentially serious consequences.
What the malicious extension did
The extension shipped with an automated installation script. When executed, that script ran obfuscated code designed to contact an external server.
The server connection had two goals. It enabled remote access through a reverse shell technique, and it allowed the attacker to exfiltrate data from the infected machine.
A reverse shell works by making the victim’s machine reach out to the attacker’s server. This gives the attacker command-line access while bypassing typical firewall protections.
Targeted data included credentials and local files stored on the developer’s system. Environment variables, API keys, and configuration files are common targets in this kind of attack.
Anyone who installed the extension should assume their machine may be compromised. Even a brief connection to the malicious server could be enough for the attacker to act.
If you installed this extension, treat your machine as fully compromised. Do not wait for visible evidence of an attack before acting.
How the attack was hidden
The malicious payload was embedded in a script that appeared routine. Obfuscation made it difficult to detect during a casual review of the code.
The extension used the Claude Code name to look official. Developers searching for Anthropic’s popular coding assistant would have found this fake and assumed it was the real thing.
This is a classic supply chain attack. The attacker abused trust in a well-known brand to deliver malicious code directly into developer environments.
How it was discovered
Security researchers identified the threat and analyzed the extension’s behavior. Their findings triggered a report to Cursor.
Cursor removed the extension from the marketplace after the report. Any user who installed the fake extension was exposed to the attack, and the risk does not disappear simply because the listing is gone.
What to do if you installed it
Take these steps now to reduce the damage:
- Revoke stored credentials, including SSH keys, API keys, cloud tokens, and database passwords.
- Run a security scan with updated antivirus and anti-malware tools, and check for unknown processes or services.
- Review logs and connections for suspicious outbound traffic to unknown servers around the time of installation.
- Rotate passwords and tokens for every account accessed from the machine, and enable two-factor authentication.
- Reinstall the operating system if the extension ran with full privileges, especially on machines holding sensitive or production data.
The bigger issue with extension marketplaces
Cursor is not the only platform facing this problem. Developer tool marketplaces have become a major target for supply chain attacks.
Other registries, including package managers like npm and PyPI, have seen similar campaigns. Attackers publish packages that impersonate popular tools and wait for developers to install them.
Review processes at these platforms are often not rigorous enough. Automated checks miss obfuscated payloads, and manual review of every submission is rarely possible.
The result is a constant game of whack-a-mole. Malicious packages get removed, but new ones appear under different names.
The key lesson is simple: a listing on a marketplace is not a guarantee of safety.
What developers should do
Verify the publisher of any extension before installing it. Check their history and look for other trusted packages under the same name.
Read the installation script if you can. Look for encoded strings, calls to external servers, or file modifications that go beyond the tool’s expected behavior.
Test new tools in isolated environments first. Virtual machines and containers can contain damage if a tool turns out to be malicious.
Monitor your network for unexpected connections. Outbound traffic you do not recognize is one of the strongest indicators of compromise.
The bottom line
This incident shows that marketplaces are not a seal of approval. Every extension you install is code running with your privileges on your machine.
Trust nothing automatically. Verify the source, inspect what runs, and stay alert to strange behavior.
Gnoppix is the leading open-source AI Linux distribution and service provider. Since implementing AI in 2022, it has offered a fast, powerful, secure, and privacy-respecting open-source OS with both local and remote AI capabilities. The local AI operates offline, ensuring no data ever leaves your computer. Based on Debian Linux, Gnoppix is available with numerous privacy- and anonymity-enabled services free of charge.
What are your thoughts on this? I’d love to hear about your own experiences in the comments below.