Cursor removes tampered Claude Code extension, up to 5,000 users affected

Cursor said on October 29 that it had removed a tampered Claude Code extension from its marketplace. The package was anthropic.claude-code 2.1.313, with at most 5,000 users affected, according to the company. Cursor says Anthropic did not develop the malicious version. It was available that day from about 2:27 a.m. to 1:35 p.m. Pacific Time.

OpenSourceMalware found a 66-line loader before legitimate code; it identified the remaining extension and bundled binary as legitimate. StepSecurity independently found that loading the extension triggered execution, before any Claude conversation.

The initial beacon contained host, user, platform, directory, Git email and IP data, plus up to 40 credential-related environment-variable names. OpenSourceMalware says the actual secret values were excluded.

StepSecurity’s sandbox confirmed an attacker-controlled SSH key, a reverse tunnel and persistence. SSH supports remote computer access; here an outbound connection attempted it. macOS background jobs or Windows scheduled tasks and startup entries retried every 60 seconds.

OpenSourceMalware says service activation can fail without sufficient privileges while the remaining code continues. Successful remote access and residual keys or files are separate questions. Cursor says ordinary privileges prevented login on most macOS and Windows hosts. It rebuilt the marketplace, rotated keys and disabled the attack server.

Distribution and cleanup boundaries

Socket found no publication or removal record for 2.1.313 in Open VSX’s public history and its own ingestion logs. Its review from October 27 through October 30 at 05:35 UTC included platform builds of the adjacent versions. OpenSourceMalware corrected its report to identify Cursor’s marketplace as the source.

Socket also found 2.1.313 absent from npm’s publication records and official GitHub releases. It cautions that a missing number alone proves no incident, and says it has not analyzed the actual artifact. The confirmed Cursor incident does not establish distribution through other registries.

Checking a clean release and removing an implant are separate tasks. StepSecurity says it downloaded 2.1.312 and 2.1.314 from Open VSX and found neither contained the malicious indicators. Anthropic’s official GitHub release list also shows 2.1.314 dated October 30. Installing a newer extension does not itself demonstrate removal of standalone background files already left on a machine.

Cursor’s macOS script stops tunnels and background jobs and removes marked extension bundles and dropped files. It preserves other keys and file attributes, handles keys sharing a line, and rechecks remaining processes and keys. Incomplete cleanup returns an error; it requires the affected user’s account. The macOS script rejects root execution. It follows existing key-file symlinks and preserves ownership and permissions during cleanup.

The Windows script requires administrator privileges and checks each user profile. It matches malicious code markers rather than relying on extension-folder version numbers. It stops scheduled tasks and tunnels, removes startup and temporary files, and cleans the attacker key. Files still in use or remaining processes produce warnings and failure status.