Cursor warns malicious Claude Code extensions can leave a backdoor
Cursor updated its security notice on October 30 to identify two malicious Claude Code extension versions distributed through its marketplace. Developers who installed them face cleanup beyond the editor: the payload can leave SSH keys and startup scripts elsewhere on their machines.
Spec sheet
- Affected copies
- Anthropic.claude-code 2.1.312 and 2.1.313
- Distribution channel
- Cursor VS Code Extension Marketplace
- Platforms identified
- macOS and Windows
- Exposure window
- 29 Oct, 09:27–20:35 UTC
- Notice updated
- 30 Oct 2026, 18:30 UTC
A marketplace incident
Cursor first disclosed the incident on October 29. Its update clarified the affected versions and added indicators for investigators. The company says it removed the packages, audited other extensions, rotated keys and rebuilt the marketplace. It also arranged for the attacker’s server to be taken offline.
The official distribution was separate
Microsoft’s October 30 investigation confirms that the malicious packages did not reach the Microsoft Visual Studio Marketplace or Anthropic’s official npm distribution. Anthropic told Microsoft that its own systems were not compromised. Microsoft analyzed JavaScript injected into the extension, which ran before the extension’s expected code.
Files outlast the extension
The injected code collected host information and attempted to establish remote access through SSH. Microsoft describes startup scripts stored outside the extension directory, including a macOS LaunchAgent and Windows startup mechanisms. Those locations explain why replacing the extension does not remove every artifact. Server takedown also leaves files already written to a workstation in place.
Microsoft’s response guidance separates evidence collection from cleanup. Installation records identify which distribution channel delivered the package; endpoint and network records help establish what happened after it loaded. Its investigation also warns that a missing key marker alone cannot establish that a machine is unaffected.
Claim check
- Confirmed The updated notice identifies two tampered extension versions and supplies package hashes. [1]
- Company claim Cursor says it found no other tampered extensions and took the attacker’s server offline. [1]
- Unclear Successful attacker login is not established for every affected host; privileges and SSH configuration determine access. [2]
Sources
- Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor · 30 Oct
- Inside a malicious Claude Code-branded extension and its persistent SSH backdoor · Microsoft Security Research · 30 Oct