An attacker published tampered versions of the Claude Code extension to Cursor’s marketplace on October 29, and the malicious builds stayed available for about 11 hours, according to SecurityWeek. Versions 2.1.312 and 2.1.313 of the extension, published under the name anthropic.claude-code, targeted macOS and Windows users.
Anthropic says it did not build or publish the tampered versions, that only Cursor users were affected, and that the malicious builds were not pushed to the Microsoft Visual Studio Marketplace, Open VSX or npm. Researcher Kevin Beaumont estimated that roughly 5,000 developer systems may have downloaded them.
The malicious JavaScript ran when modules loaded. It collected host details including the hostname, username, operating system, architecture, working directory and global Git email, and it tried to install an SSH key, enable SSH and open a reverse tunnel for remote access. It also set up persistence through platform-specific scripts and startup configurations and sent host details back through a delayed callback. Cursor says enabling SSH needs administrator rights, which the extension lacked on most systems, so the attackers likely could not log in through the tunnel.
Cursor removed the extension, briefly suspended its marketplace, found no other malicious extensions, rotated all keys, rebuilt the marketplace and reopened it, and worked with the hosting provider to take the attacker’s server offline. Anthropic released its legitimate extension as version 2.1.314.
Developers who installed either bad version should remove it, run Cursor’s detection script and check the published indicators of compromise. Hosts that show signs of payload execution should be isolated, unauthorized SSH keys, persistence mechanisms and tunnel processes removed, and rebuilding the machine considered, because uninstalling the extension alone may not stop the dropped scripts.