Cursor distributed tampered Claude Code extensions through its marketplace on 29 October, prompting a security warning for macOS and Windows users. Versions 2.1.312 and 2.1.313 attempted to establish persistent SSH access. Microsoft’s 30 October analysis limits the incident to Cursor’s marketplace and warns that malicious files can remain even when remote access fails.[1][2]
What we know: Cursor identifies a distribution window of approximately 02:27 to 13:35 Pacific Daylight Time on 29 October.[1]
What we don't know: The Cursor notice and Microsoft analysis reviewed here provide no count of successful attacker logins.[1][2]
Why it matters: Microsoft says removing or updating the extension leaves separately written keys, scripts and startup entries requiring cleanup.[2]
Scope before speculation
Microsoft says the malicious packages never reached Visual Studio Marketplace or the official npm distribution. It also reports Anthropic’s confirmation that its systems were uncompromised.[2]
The Register separately covered the incident and Anthropic’s denial on 30 October, quoting technical staff member Felix Rieseberg. Its account relays vendor findings rather than establishing an independent victim count.[3]
Cursor says it removed the packages, rebuilt the marketplace, rotated keys and arranged the attacker server’s takedown.[1]
Failed access still needs investigation
Microsoft’s code analysis describes host reconnaissance, an attacker-controlled SSH key, reverse forwarding and startup persistence. Remote login depends on privileges, local SSH configuration and the attacker’s server settings.[2]
The reconnaissance callback collects selected environment-variable names. Microsoft distinguishes that collection from theft of the secret values; subsequent credential exposure requires investigation.[2]
For triage, separate three questions: was the affected package installed, did its loader execute, and did an unauthorised session occur? Treating these as separate checkpoints helps avoid equating an installation record with a completed intrusion.
Microsoft recommends preserving evidence, correlating installation records with endpoint and network telemetry, and isolating devices showing loader execution or backdoor installation. Investigators should confirm the unauthorised key by fingerprint, examine startup actions and review authentication activity. Credential rotation or session revocation should follow evidence of exposure or an inability to restore device trust.[2]
Sources
- Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Extension Marketplace · Cursor
- Inside a malicious Claude Code-branded extension and its persistent SSH backdoor | Microsoft Security Blog
- Anthropic: That Claude Code extension compromise… couldn't be us
