Cursor says malicious Claude Code extension reached up to 5,000 users
Cursor says version 2.1.313 of the Claude Code extension was available in its extension marketplace for about 11 hours on 29 October, affecting at most 5,000 users. The company says the package was not developed by Anthropic; it installed an SSH backdoor and persistence mechanisms, and Cursor has removed it and taken the attacker’s server offline.
Bottom line — Cursor advises affected users to check for the backdoor and run its remediation steps; updating or uninstalling alone may not remove it.
Go deeper 6
-
Cursor says the package was available from 2:27am to 1:35pm Pacific time and that it will contact affected users directly.
-
OpenSourceMalware found a 66-line loader in the extension that ran when the extension loaded, without requiring a Claude conversation.
-
OpenSourceMalware says the code added an SSH key labelled svc-telemetry and sent host details; the initial beacon included environment-variable names, not their values.
-
Cursor says it removed the package, shut down its marketplace temporarily, rotated keys, rebuilt the service and worked with the hosting provider to take the attacker’s server offline.
-
Rescana and OpenSourceMalware report that early claims of an Open VSX listing were corrected; Cursor identified its own marketplace as the source of the malicious package.
-
Cursor says it has no evidence that other extension versions or the official distribution were affected. How the package entered the marketplace and who was responsible remain unknown.
www.instagram.com