GoKawiilMalicious extension found on Cursor's marketplace targeted developer machines
Security researchers discovered a fake extension on Cursor's marketplace designed to impersonate a Claude Code tool and give attackers persistent access to developers' computers. The extension was distributed through Cursor's official marketplace, exploiting trust in the platform to reach developers using AI coding assistants.