Malicious Claude Code extension threatens 5,000 users with data theft

a tampered version of the claude code extension was available in cursor's vs code extension marketplace on thursday for about 11 hours. the extension attempted to harvest user data like hostname, username, operating system, and public ip address. it also tried to set up remote access for the attacker, though that likely wouldn't have worked on most machines since it requires admin privileges. cursor says up to 5,000 users were affected. once discovered, cursor pulled the extension and took the entire marketplace offline.