Observed incident

Cursor marketplace distributes a malicious Claude Code extension

Reported

Published here

What happened

Cursor identifies tampered Anthropic.claude-code 2.1.312 and 2.1.313 packages for Windows and macOS. They collected host details and attempted persistent SSH access.

Parties and reporting

AI tools and systems: Cursor Extension Marketplace, Anthropic.claude-code 2.1.312 and 2.1.313, SSH persistence

Outcome

Cursor removed the package, rebuilt the marketplace and disabled the attacker’s server with its host. SSH login generally failed without admin privileges, but installed keys and persistence still require remediation.

Operating lesson

Isolate affected hosts, inspect extension and endpoint telemetry, remove persistence or rebuild, and rotate reachable credentials from a trusted system.

Evidence and limits

Distributed October 29, approximately 02:27–13:35 PT. The provider notice rechecked November 1 names both 2.1.312 and 2.1.313 and no longer gives the earlier affected-user upper bound; a current count is not established. Environment-variable names, not values, were collected initially. Cursor reports no evidence affecting other versions or the official distribution; the malicious packages were not developed by Anthropic.

Sources