October 13, 2026
Plutonium checks extensions before you install them: a free scanner and a database of 4,500 components
A fake in the Cursor extension marketplace racked up 428K downloads in 19 hours, and the malware stayed on the system after the extension was removed.
On Sep 24, a fake Solidity extension appeared in the Cursor extension marketplace. It stole private wallet keys.
The counter lies. The extension alejandroaranda.solidity-languini and copies of juanblanco.solidity showed about 428,000 downloads, inflated by bots (Pluto Research, Sep 24–26, 2026). The code weighed 37.6 MB and was hidden inside a 205 MB video file. It ran when the editor started, before the user's first click.
Each wave lived for about 19 hours and came back to the marketplace within a day of removal.
Clean up by hand. Removing the extension does not remove the malware. On Windows, Pluto says to look for the service "ScreenConnect Client (5cbe79c9c25524df)" and a folder of the same name in Program Files (x86). If it's there, reinstall the machine.
On macOS and Linux, check ~/.solidity/, the file com.solidity.langsupport.runner.plist in ~/Library/LaunchAgents and the unit solidity-langsupport-runner in ~/.config/systemd/user. In either case, disconnect the machine from the network and rotate wallet keys, deploy keys, SSH keys and cloud tokens.
Check before installing. The Plutonium scanner is free and needs no sign-up: you feed it an MCP server, skill, plugin or connector and get it tagged across five risk types, from command execution to sharing data with third parties. As of Oct 13, 2026, its database holds more than 4,500 extensions, connectors and MCP servers, alongside guides to secure setup.
Until now, an extension's safety was judged by its download count and rating. In April, Pluto counted 179 MCP servers exposed to the internet, 147 of which accepted requests without authentication, and 1,184 malicious skills in the ClawHub registry. The company's conclusion: bots inflate counters and stars.
The money for this came on Oct 13: $42 million across two rounds, an $8.5 million seed led by TLV Partners and a $34 million Series A led by Jump Capital. Pluto started selling in April 2026 and within six months reached $2 million in annual recurring revenue with more than 30 enterprise customers, including Oscar Health, Workato and Sixt.
60% of the risks found come not from developers but from tools built by people in finance, marketing and legal.
By Pluto's measurement, a new AI tool lands inside the corporate perimeter two hours after its release.