# Cursor · Drain Watch

3 incidents, 0 live. JSON: https://drains.watch/t/cursor.json · RSS: https://drains.watch/t/cursor/feed.xml

- [TrapDoor packages on npm, PyPI and Crates.io steal wallet data and plant hidden prompts for AI coding tools](https://drains.watch/i/trapdoor-supply-chain-ai-assistant-config-poisoning-may-2026) (closed, High, Partly contained, since May 26, 2026)
- [Malicious 'contractshark.solidity-lang' Cursor extension steals an Ethereum core developer's private key](https://drains.watch/i/cursor-contractshark-solidity-extension-dev-key-theft-aug-2025) (closed, Medium, Partly contained, since Aug 13, 2025)
- [Fake Solidity extension for the Cursor AI code editor leads to about $500K crypto theft from a developer](https://drains.watch/i/cursor-fake-solidity-extension-500k-crypto-theft-jul-2025) (closed, High, Partly contained, since Jul 10, 2025)