Cursor warns of malicious Claude Code extensions and persistent SSH payload

What happened?

Cursor says maliciously modified Anthropic.claude-code extensions were available in its VS Code Extension Marketplace on October 29 from about 2:27 a.m. to 1:35 p.m. Pacific. Its current notice identifies versions 2.1.312 and 2.1.313 for Windows and macOS; an October 30 update clarified the affected versions and indicators. Reuters reported Cursor’s estimate that at most 5,000 users were affected. That is an upper bound, not a count of successful attacker logins.

According to Cursor, the payload collected host and user details, attempted to add an attacker-controlled SSH key and create a persistent reverse tunnel, and established persistence mechanisms. Cursor says errors in the code and the administrative privileges normally required to enable the SSH service meant the attacker could not log in through the tunnel on most affected hosts. The company nevertheless warns that an unauthorized key, persistence and host-data transmission can occur. It says the attacker server has been taken offline.

Security researchers at OpenSourceMalware analyzed the modified package and corrected an initial attribution to Open VSX, identifying Cursor’s marketplace as the source. Anthropic technical staff said its own systems and official distribution channels were not compromised; Cursor says it found no evidence that other extensions were tampered with.

Anyone who installed or updated either listed version from Cursor’s marketplace on Windows or macOS during the window should review Cursor’s current notice and indicators. Cursor advises isolating hosts showing payload execution, removing keys, persistence and tunnel processes, considering a rebuild, and rotating accessible credentials and sessions from a trusted system. Uninstalling the extension alone may not remove persistence; a negative check for one indicator is not proof that a host is safe.

Source: Cursor ↗ · Source: OpenSourceMalware ↗ · Source: Reuters ↗ · Source: Anthropic technical staff via Hacker News ↗

Why does it matter?

Developer extensions execute with access to working environments, so a compromised distribution channel can matter even when the original publisher’s systems remain intact. Teams should reconcile installation and endpoint records with the vendor’s evolving guidance rather than assume every exposure led to a successful intrusion—or that one clean indicator settles the investigation.