A malicious Claude Code plugin slipped into Cursor's official marketplace

A malicious Claude Code plugin has appeared in the official plugin marketplace of Cursor, according to a report carried by Sina News. The headline names the three elements that matter: Cursor, its official marketplace, and a Claude Code extension described as malicious.

The confirmed information is concentrated on the event itself — a plugin with malicious behaviour showing up inside an official distribution channel. The details that usually accompany a security advisory are absent from the report's headline and summary: the plugin's name, when it was listed, how many developers installed it, and whether it has since been pulled. Those points should be treated as unconfirmed until Cursor or a security vendor publishes more.

Understanding the weight of this requires seeing where Cursor and Claude Code each sit. Cursor has become one of the fastest-growing AI coding tools, and its marketplace lets developers install third-party extensions that wire model capability, code search and automation into the editor. Claude Code, Anthropic's terminal coding agent, has meanwhile grown an ecosystem of commands, hooks and workflow configuration. A marketplace is precisely where those two layers meet.

That connection is also where the risk lives. Coding agents are built to hold broad permissions: they read and write repositories, execute shell commands, touch project configuration and reach into environment secrets. A plugin that inherits those permissions is effectively executable code inserted into a developer's toolchain. And because an official marketplace carries an implicit promise of review, a malicious listing there is far more damaging than one found in an unfamiliar repository.

It also shows how plugin marketplaces are becoming a new attack surface for AI coding tools. Package registries, browser extensions and IDE plugins have long been common entry points for supply-chain attacks, but agentic tools widen the blast radius: an extension no longer merely edits text in a buffer, it can act on the codebase and the machine behind it.

The practical response for developers is a self-audit — review recently installed plugins and their publishers, narrow the credentials available to the agent, and keep production secrets out of reach of the editor process. For teams, an allowlist and centralized extension management tend to be more reliable than leaving the call to each developer.

What matters next is the official response. Whether Cursor removes the plugin, publishes changes to its review process, or whether the Claude Code plugin ecosystem adopts signing and explicit permission declarations will decide if this stays an isolated incident or becomes the moment AI coding tools were forced to harden their extension supply chain.