Malicious Claude extension may have hit 5,000 users
Cursor removed a manipulated version from its extension marketplace after it attempted to install an SSH backdoor.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
A manipulated version of Anthropic’s Claude Code extension was in the Cursor marketplace for several hours on Thursday. According to Cursor, up to 5,000 users may have been exposed to code that collected system information and attempted to provide persistent access.
The affected version was 2.1.313 of the extension named anthropic.claude-code. Cursor says this version was not developed by Anthropic. According to the company, the extension was available from approximately 02:27 to 13:35 Pacific Time on 29 October.
The malicious code attempted to add an SSH key to the authorized_keys file, enable the local SSH service and establish a reverse SSH connection. It also collected, among other things, the computer name, username, operating system, public IP address and names of certain environment variables.
Cursor says the most important step would have failed on most computers because it required administrator privileges. That limits the possibility of logging in remotely, but according to the company, the extension and the persistence code it left behind could still send system information.
Cursor removed the version, blocked further distribution and temporarily shut down the marketplace. The company says no other extensions were altered and that the attacker’s server was taken offline. The marketplace was subsequently rebuilt and brought back online.
Cursor advises users who installed or updated the extension during the specified time window to check their systems. According to the company, simply removing the extension may not be sufficient, because the code could leave separate files and startup scripts behind. Cursor also advises renewing access credentials from a trusted system if a computer shows signs of infection.
Uncertainty remains about the wider distribution. Security company Socket found no public publication record for version 2.1.313 in Open VSX or npm, while Cursor confirms distribution through its own marketplace. The current evidence is therefore strong for an incident in Cursor, but not for a compromise of Anthropic’s official distribution channels.
One story, several perspectives
What is established
- A manipulated extension was temporarily available in the Cursor marketplace.
- Cursor removed the extension and later brought the marketplace back online.
- There is no confirmed evidence that Anthropic’s official distribution channels were compromised.
Left
Arguments Platforms that distribute software should organise stricter controls, transparency and accountability, because individual developers cannot check all dependencies.
Values Collective security, worker protection and limiting the concentration of power among technology companies.
Consequences More oversight and audits could prevent incidents, but would increase costs and could reduce the speed of open software distribution.
Centre
Arguments A risk-based approach is the obvious choice: strong controls for popular or sensitive extensions, rapid warnings and clear recovery procedures.
Values Proportionality, innovation and responsible risk management.
Consequences This could limit the damage without closing all marketplaces completely in advance, but would require continued cooperation between platforms and researchers.
Right
Arguments Organisations should decide for themselves which extensions to install and ensure their own security is in order; platforms should mainly provide clear information.
Values Personal responsibility, freedom of choice and limited platform liability.
Consequences Fewer prior blocks keep software accessible, but could make smaller companies and individual developers more vulnerable.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The technical operation, time window and measures are taken directly from Cursor and confirmed by independent reporting. The article makes the uncertainty surrounding Open VSX and npm explicit.
- confirmed Version 2.1.313 was in the Cursor marketplace on 29 October. — Cursor itself names the version and distribution channel. source
- confirmed Up to 5,000 users may have been exposed. — Cursor gives this as the upper limit; CNA reports the same statement. source
- confirmed The code attempted to install an SSH backdoor and persistence. — The technical description appears in the official security notice. source
- uncertain Open VSX and npm demonstrably distributed the version. — Socket found no publication record for this; the article therefore does not present it as established fact. source