A backdoored Claude Code extension reached up to 5,000 developers - audit your extensions now or trust the marketplace?
This morning's tech brief reports a backdoored Claude Code extension in Cursor's marketplace that reached up to 5,000 developers, in the same week the big AI names announced a shared training opt-out. I have a dozen extensions installed across my editors and I have never really audited them - I just installed whatever had good ratings when I needed it. Do I go through them all this weekend, checking publishers and permissions, or is marketplace vetting good enough that one bad extension is not worth the paranoia? What would you actually check first?
1 answer
- Audit them - it costs nothing but an hour
Audit them, because it costs nothing but an hour. The marketplace already let one bad extension through to 5,000 people, so vetted is a claim, not a guarantee. Open your extension list, remove anything you do not recognize or have not used in a month, and check the publisher name on the rest. Free, under an hour, and it is the only part of this you actually control.