Cursor users are being urged to immediately reset their credentials and perform comprehensive system cleanups following a supply chain compromise involving a malicious update to the Claude Code marketplace extension. The security incident has prompted urgent warnings for users of the popular code editor, with specific remediation steps required for both macOS and Windows platforms CryptoSlate.
The attack originated through the Claude Code extension marketplace, where threat actors managed to distribute a compromised update. Users who installed or updated the extension during the affected timeframe may have introduced malicious components onto their systems, creating immediate security risks that extend beyond simple software removal. The incident represents a significant supply chain security breach within the development tool ecosystem, where extensions and marketplace add-ons serve as critical components of modern coding workflows.
According to security guidance provided following the incident, affected users face a complex remediation process that requires more than standard software uninstallation. Simply removing the extension or the Cursor application may leave persistent malicious components active on host systems, requiring dedicated cleanup efforts to fully eradicate the threat from both macOS and Windows machines. This persistence mechanism means that victims cannot rely on conventional removal methods to secure their environments.
The recommended response involves two critical security measures: comprehensive credential rotation and thorough host system sanitization. Users must rotate credentials for all trusted systems and services accessed from affected machines, treating stored passwords, API keys, and authentication tokens as potentially compromised. This trusted-system credential rotation is essential because the malicious update may have harvested sensitive authentication data during its active period on infected systems.
Host cleanup procedures are equally critical given the persistent nature of the threat. The malicious components appear designed to survive standard uninstallation processes, meaning users must perform detailed system scans and manual verification steps to ensure complete removal of all artifacts from their installations. Security professionals emphasize that surface-level removal of the application fails to address underlying system modifications that may remain active.
Supply chain attacks targeting development tools pose particular risks to the cryptocurrency sector, where developers frequently handle sensitive private keys, wallet credentials, and proprietary smart contract code. The Cursor incident demonstrates how marketplace extensions—trusted components in daily development workflows—can serve as vectors for credential harvesting and system compromise, necessitating rigorous security protocols when installing third-party tooling updates.