Tampered Claude Code extension sat on Cursor's marketplace for hours

A tampered version of the Claude Code extension sat in Cursor’s VS Code extension marketplace on Thursday, and Cursor says up to 5,000 people installed it. ¹²

What happened

The malicious version, 2.1.313, was live for roughly 11 hours. Cursor’s own notice puts the window at 2:27 a.m. to 1:35 p.m. PT on October 29, while other outlets report 5:27 a.m. to 4:35 p.m. ET, which is the same stretch. ³⁴ Cursor says its own tally is “at most 5,000 users.” ²

The extension tried to install a persistent SSH backdoor. It collected hostname, username, operating system, home directory path, environment variable names, configured Git email and public IP address. It then tried to add an attacker’s SSH key, turn on the local SSH service and open a reverse tunnel, which is a connection the infected machine makes outward so the attacker can reach in. ¹⁴

What is confirmed, and what isn’t

There was a lucky break. Turning on the SSH service needs admin rights, which the extension lacks on most Windows and macOS machines, so on those hosts the tunnel step fails. Cursor says the key and persistence scripts were still installed and host details were still sent out, so it wants everyone to remediate regardless. ⁴ Researchers at Phorion, who spotted it first, called the flawed code a stroke of luck. ²

The unanswered question is how it got onto the marketplace. Ars Technica reports that it was distributed through an account labeled as Anthropic’s official one, and that neither company has explained how attackers gained control. ¹ Cursor’s notice says the versions “were not developed by Anthropic.” ⁴ An Anthropic staffer posted on X that Anthropic’s systems and employee laptops were not compromised and that an actor used access to Cursor’s marketplace to publish the copy. ² Cursor did not answer WIRED’s question about whether its own systems were breached. ² Anthropic had not publicly warned customers as of Ars Technica’s report. ¹

Seen it before: a package marketplace, a trusted name, and an account nobody can yet explain.

What you should do

If you installed or updated Anthropic.claude-code 2.1.312 or 2.1.313 from Cursor during that window, check your SSH authorized keys file for an entry labeled svc-telemetry. Cursor’s notice has a one-line check for macOS and a PowerShell version for Windows. ⁴ If it is there, Cursor says to:

• Run its remediation script for your platform.
• Isolate the host.
• Rotate credentials reachable from the machine, from a trusted system.

Uninstalling the extension alone may not be enough, because the payload drops standalone persistence scripts that keep running. ⁴ Rotating credentials is cheap and the stolen variable names suggest an attacker was taking inventory. Phorion’s read is that it let the operator spot machines holding cloud credentials and API tokens for follow-up attacks. ¹

Cursor says it removed the bad version, blocked distribution, worked with the hosting provider to knock the attacker’s server offline, rotated keys, and confirmed no other extensions were tampered with. ⁴³ The marketplace is back online. ¹

Our read: The fast cleanup is a good sign, and so is Cursor’s detailed, script-equipped notice. The missing piece is the entry point. Until Cursor explains how someone published under a trusted name, “no other extensions were tampered with” is a claim to watch, not a closed case. Expect that explanation to be the next thing developers ask for.

Footnotes

1. Ars Technica, “Anthropic VS code extension on Cursor backdoored for nearly 12 hours”. Retrieved October 30, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

2. WIRED, “A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Devices”. Retrieved October 30, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

3. The Verge, “Cursor says around 5,000 people may have installed a malicious Claude Code extension.”. Retrieved October 30, 2026. ↩ ↩²

4. Cursor, “Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace”. Retrieved October 30, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷