AnswersPublished24 sources
A Trojanized Claude Code Extension Reached Cursor Users for 11 Hours
On October 29, 2026, Cursor’s marketplace served a tampered Claude Code extension, version 2.1.313, for about 11 hours; Cursor estimated at most 5,000 users received it. Later evidence traced the malicious build to Cursor’s marketplace—not Open VSX, Microsoft’s marketplace, or the npm package—and identified 2.1.314...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- On October 29, 2026, Cursor’s marketplace served a tampered Claude Code extension, version 2.1.313, for about 11 hours; Cursor estimated at most 5,000 users received it.
- Later evidence traced the malicious build to Cursor’s marketplace—not Open VSX, Microsoft’s marketplace, or the npm package—and identified 2.1.314 as the clean replacement.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What happened in the October 29, 2026 compromise of Claude Code extension version 2.1.313 in Cursor’s marketplace, including its roughly 11-. Article summary: On October 29, 2026, a trojanized Claude Code extension, `anthropic.claude-code` version `2.1.313`, was served through Cursor’s extension marketplace from approximately 2:27 a.m. to 1:35 p.m. Pacific—about 11 hours—and r. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fa
On October 29, 2026, a tampered build of the Claude Code extension, anthropic.claude-code version 2.1.313, was available through Cursor’s extension marketplace from about 2:27 a.m. to 1:35 p.m. Pacific—roughly 11 hours. Cursor said at most 5,000 users received it. That is an exposure estimate, not a count of machines confirmed to have suffered successful remote access. 2
4
The incident matters because the extension tried to add an attacker-controlled SSH key and create a persistent route back to affected computers. Here’s what the evidence establishes—and what users should check.
Where the malicious extension was distributed
Some early reports attributed the compromised version to Open VSX. Subsequent analysis identified Cursor’s own marketplace as the distribution source. Open VSX, Microsoft’s Visual Studio Marketplace, and the @anthropic-ai/claude-code npm package were reported clean; their version listings moved from 2.1.312 to 2.1.314, without 2.1.313. 10
13
19
22
The malicious package used the legitimate extension identity, rather than presenting as an obvious lookalike. Cursor’s notice says the affected marketplace listings included Windows and macOS builds of 2.1.312 and 2.1.313; users checking their systems should therefore follow Cursor’s notice rather than relying only on the 2.1.313 version number. 4
19
Anthropic did not develop the tampered build. The available incident reports identify Cursor’s marketplace as the source but do not establish how the attacker obtained access to publish there. 4
16
What the injected code tried to do
Researchers found a 66-line loader inserted before the extension’s normal code. It gathered host and user details, including the computer’s hostname, username, operating system, environment-variable names, Git email, and public IP address. 1
8
The loader also tried to add an attacker-controlled SSH key labelled svc-telemetry to the user’s authorized_keys file, set up persistence, and open a reverse SSH tunnel. The reported persistence mechanisms included a macOS LaunchAgent and a Windows scheduled task; background scripts attempted to retry the tunnel roughly every 60 seconds. 1
8
41
Cursor said the code’s attempt to enable the local SSH service would generally fail because of errors in the malicious code, except in unusual circumstances such as Cursor being started with administrator privileges. That limitation reduced the likelihood that the intended remote-access route worked on typical machines, but it does not by itself establish whether any particular device was affected. 41
Containment and the clean replacement
Cursor removed the malicious package and temporarily took its extension marketplace offline. Reporting also says Cursor rebuilt the marketplace, rotated publishing or signing keys, and worked to take the attacker’s server offline. 18
23
Version 2.1.314 was identified as the clean replacement and appeared on Open VSX and Microsoft’s Visual Studio Marketplace. 4
10 Replacing or uninstalling the extension addresses the malicious package, but users should also check for artifacts the code may already have written.
4
8
What affected users should check
If you installed or updated the extension through Cursor during the exposure window, use Cursor’s security notice and remediation guidance to review the machine. In particular:
- Look for the
svc-telemetrykey in SSH authorization files and check for related persistence, such as the reported macOS LaunchAgent or Windows scheduled task.1
4
- Update to the clean
2.1.314release and run Cursor’s remediation steps; do not assume that updating or uninstalling alone removes artifacts already installed.40
- Rotate credentials that were accessible from a potentially affected machine. If you find suspicious artifacts, isolating the machine while investigating is a prudent precaution—not proof that an attacker successfully connected.
6
The central distinction is between an extension being delivered and a backdoor being successfully activated. The reports establish an attempted persistent SSH backdoor and an estimated exposure of up to 5,000 users; they do not establish that all exposed systems were compromised in the same way. 2
8
41
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "A Trojanized Claude Code Extension Reached Cursor Users for 11 Hours"?
On October 29, 2026, Cursor’s marketplace served a tampered Claude Code extension, version 2.1.313, for about 11 hours; Cursor estimated at most 5,000 users received it.
What are the key points to validate first?
On October 29, 2026, Cursor’s marketplace served a tampered Claude Code extension, version 2.1.313, for about 11 hours; Cursor estimated at most 5,000 users received it. Later evidence traced the malicious build to Cursor’s marketplace—not Open VSX, Microsoft’s marketplace, or the npm package—and identified 2.1.314 as the clean replacement.
Sources
ox.securityMalicious Claude Code Extension Installs SSH Backdoor ...
microsoft.comInside a malicious Claude Code-branded extension and its ...
brandefense.ioMalicious Extensions: Claude Code Playbook