# Socket Weekly: Malicious Claude Code Extension Pulled From Cursor… Canonical: https://brew.new/templates/socket/socket-weekly-malicious-claude-code-extension-pulled-from-cursor Brand: socket.dev Category: newsletter ![Preview of Socket Weekly: Malicious Claude Code Extension Pulled From Cursor…](https://cdn.brew.new/email-preview-be83f00342aca641-tracking_r57wp8t0r4t5qgpxzh2hm4f4698he5s0-1793604105324.png) ## Email content Socket Weekly Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes. Feross Aboukhadijeh Feross Aboukhadijeh Founder & CEO at Socket Top Story Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace Cursor hosts its own mirror of Open VSX, serving self-hosted copies to users rather than pulling files live from external servers, a nuance the media struggled to make sense of this week when a tampered Claude Code extension reached Cursor users. Anthropic’s official distribution channels on Open VSX, npm, and Microsoft’s marketplace never published that version, which our registry checks confirmed. Cursor has removed the extension, rotated its keys, and rebuilt its marketplace in response to the attack. Read more More News Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users We tracked 319 browser extensions installed by roughly 13.4 million users that exist only to take over the browser’s default search engine, route every query through the operator’s own proxy, and collect referral payments from Yahoo or Bing. The operators have been running this for a decade, buying installs through junk ad networks and keeping the listings unlisted in the Chrome Web Store so they never surface in search. Read more OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole A user reported that OpenCode’s free usage limits could be reset by switching IP addresses through a VPN, then later reopened the issue to promote the same loophole and brag about running 130 agents through it. The thread was deleted after participants went feral on the reporter for ruining the workaround. It’s a raw snapshot of where AI coding is right now, as developers chase more capable models, longer sessions, and enough compute to keep fleets of agents running. Read more More Worth Reading eMudhra, Brotli, and the Long Tail of a Security Fix Navigating Open Source Software Development in the Generative AI Era: Balancing Velocity and Community Health Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets Citation Needed: It's Always North Korea The AI cost of JavaScript frameworks OpenAI paused frontier training for 11 days after a model reached the live internet Socket on X Socket on GitHub Socket on LinkedIn Socket on Bluesky Socket Inc. Secure your supply chain. Ship with confidence. 2810 N Church St., Wilmington, DE 19802 Book a Demo · Unsubscribe [Open and remix this design](https://brew.new/templates/socket/socket-weekly-malicious-claude-code-extension-pulled-from-cursor) [Browse email designs](https://brew.new/browse/templates)