Cursor has linked a malicious Claude Code extension to its marketplace, but the provenance of the examined directory has not been established, leaving developers without a confirmed count of affected machines.
Reuters reported that Cursor estimated up to 5,000 users may have been exposed. That estimate does not establish how many people installed or ran the add-on, as EconoTimes’ earlier coverage of the estimate noted.
A code review of the macOS package for Apple Silicon, version 2.1.313, found a 66-line loader positioned before the extension’s standard functions. The loader could run when the extension loaded, without a user starting a Claude conversation.
The code was configured to transmit host information to 134.209.82.225 on port 8099 and open a reverse tunnel to that server. It also could add an attacker-controlled SSH key labeled svc-telemetry and establish startup persistence.
A separate malicious copy also surfaced on Open VSX. The analysis did not establish where the directory originated. It did not determine how many devices were affected or confirm successful remote access or cryptocurrency theft.
The code review found no references to wallets, blockchain addresses, contracts or RPC endpoints. For crypto teams, the possible exposure is indirect: developer devices and the accounts accessible from them.
