Covered by 3 outlets — first reported by Cursor Blog (community feed), Oct 29, 12:00 UTC
Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace
MentionsAnthropic
Summary
Cursor has confirmed that a malicious version of the Claude Code extension, labeled 2.1.313, was available through its extension marketplace on October 29. Socket says the extension potentially affected up to 5,000 users. Socket adds that the disclosure identifies Cursor's marketplace as the distribution source of a malware report first attributed to Open VSX, where its investigation found no matching publication or removal records. Cursor has removed the extension.
AI summary by the SecurityTabs newsroom, checked against Cursor Blog (community feed), Socket Blog. Read the outlets below for the full story.
Continue reading
3 outlets, in the order they reported it.
Cursor Blog (community feed)First report
Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace
The Hacker News
Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor
Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on…
Socket Blog
Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
Cursor has confirmed that a malicious Claude Code extension labeled version 2.1.313 was available through its extension marketplace on October 29, potentially affecting up to 5,000 users.
Explained
The technology and terms in this story. Learn more