Postmortem on Claude Code Cursor extension hack
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Microsoft Threat Intelligence reports that a tampered Claude Code extension (versions 2.1.312 and 2.1.313) was served from the Cursor extension marketplace for several hours on October 29, 2026, in a supply-chain attack.