# Cursor IDE Malware Extension Compromise in $500k Crypto Heist

DevFeed: [Cursor IDE Malware Extension Compromise in $500k Crypto Heist](<https://devfeed.tech/articles/cursor-ide-malware-extension-compromise-in-500k-crypto-heist-7877.md>)

Original publisher: [Read original article](<https://snyk.io/blog/cursor-ide-malware-extension-compromise-in-usd500k-crypto-heist/>)

Author: Liran Tal

Published: 2025-07-21T04:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [cursor](<https://devfeed.tech/topics/cursor.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [incident](<https://devfeed.tech/topics/incident.md>), [AI-assisted coding](<https://devfeed.tech/topics/ai-assisted-coding.md>)

Tags: [agentic-ai](<https://devfeed.tech/tags/agentic-ai.md>), [ai](<https://devfeed.tech/tags/ai.md>), [application-security](<https://devfeed.tech/tags/application-security.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [cursor](<https://devfeed.tech/tags/cursor.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [extension](<https://devfeed.tech/tags/extension.md>), [ide](<https://devfeed.tech/tags/ide.md>), [incident](<https://devfeed.tech/tags/incident.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [malware](<https://devfeed.tech/tags/malware.md>), [powershell](<https://devfeed.tech/tags/powershell.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [vs-code](<https://devfeed.tech/tags/vs-code.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

A malicious Solidity Language extension installed from the unofficial Open VSX Registry reportedly executed a PowerShell script, leading to cryptocurrency theft from a Cursor IDE user. The article urges developers to scrutinize unvetted extensions and avoid unofficial third-party sources.

## Source excerpt

Learn about the recent $500K crypto heist caused by a malicious "Solidity Language" extension in Cursor IDE. Understand how compromised IDE extensions and third-party registries pose significant supply chain risks for developers and the broader AI ecosystem.