Cursor shuts down marketplace after malicious Claude Code extension hits 5,000 users, offers fix

Cursor, the coding platform owned by SpaceX, had to take down its extension marketplace after the company found a malicious Claude Code extension. This extension, the company clarified, was not developed by Anthropic, and could’ve let the attacker access user information and gain remote access.The incident, according to Cursor, impacted 5,000 users. “We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users,” the company said on X. Though it did not specify which region’s users were impacted, Cursor said, it would contact those affected directly.Cursor took down the marketplace on Friday, but restored it shortly after. The company said it worked with “relevant providers to neutralize the malware.” It also confirmed that there was no further risk. Cursor has asked all customers to update Claude Code. Cursor issued the update on X. The incident did not affect other extensions downloaded from its marketplace, or other SpaceXSI products such as Grok Bot or Grok. Cursor was acquired by Elon Musk’s SpaceX in August for $60 billion.What was the malicious Claude Code extension? According to a blog post by Cursor, the malicious extension was identified on October 29. As per the company, this extension runs “malicious code” that attempts to install a backdoor in a system. Once installed, it can collect user information including IP addresses, usernames, and operating systems.The malicious Claude Code extension also adds an attacker-controlled SSH key. This could allow the hacker to gain remote access to your machine without authorisation. And all of this information is then reported back to the hacker. The setup, according to Cursor, runs every 60 seconds. As per Opensource Malware, loading the extension was enough for the programme to run even if the user had not had a conversation with Claude.Cursor said that it audited the marketplace to find any other impacted extensions – none were found. Before restoring the marketplace, the company made some changes, including rotating security keys. It has also blocked the connection of the attacker to the server which was hosting the malware.This incident adds to a long and growing list of cybersecurity cases this month. Earlier today, Binance acknowledged a breach that may have put assets worth $6.3 billion at risk. There have also been cases, such as major vulnerabilities in PHP and weak security keys in eMudhra’s digital certificates, that have raised alarm bells.- Ends