Skip to content
securitytabs

LiveUpdated

Trojanized Claude Code Extension Distributed Through Cursor Marketplace

A tampered version of the Claude Code add-on for the Cursor code editor was offered to users on October 29 and tried to install a hidden remote-access backdoor. Anyone who installed version 2.1.313 should treat it as a possible compromise and follow Cursor's notice.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Cursor published a security notice saying a malicious version of the Anthropic.claude-code extension, version 2.1.313, was identified in the Cursor Extension Marketplace. Cursor confirmed the extension was available through the marketplace on October 29. [1][2]

The Hacker News reports that the update was distributed under the extension's legitimate publisher identity and attempted to install a persistent SSH backdoor (a hidden way to log in remotely) on affected systems, and that Cursor temporarily shut down the marketplace in response. [3]

Scale and source of the extension

Socket says the disclosure indicates up to 5,000 users could have been affected. It also says an earlier malware report had attributed the extension to Open VSX, a separate extension registry, but its investigation found no matching publication or removal records there; the distribution source was the Cursor marketplace. [2]

What is not yet known

The available articles do not say how the malicious version came to be published under the legitimate publisher identity, who is responsible, or whether any victims have been confirmed. [1][3][2]

Timeline

  1. Cursor confirmed the extension had been available through its marketplace on October 29. [2]

  2. Researchers disclosed that the trojanized extension attempted to install a persistent SSH backdoor. [3]

  3. Cursor identified malicious Claude Code extension version 2.1.313 in its marketplace and published a security notice. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Only people who use the Cursor code editor and installed or updated the Claude Code extension on or around October 29 are in scope. Cursor has published a security notice. [1][2]

What to do

  1. Ask whoever builds or maintains your software whether they use Cursor and whether version 2.1.313 of the Claude Code extension was installed. [1][2]
  2. Read Cursor's security notice and follow the steps it gives. [1]

Mid-size company

A small IT or security team

What to know

The malicious version reportedly tried to install a persistent SSH backdoor, so developer machines that received it may need to be checked beyond simply removing the extension. [3][2]

What to do

  1. Find developers who use Cursor and check whether extension version 2.1.313 was installed on October 29. [1][2]
  2. On any machine that had it, review for unexpected SSH access, since the reported goal was a persistent SSH backdoor. [3]
  3. Follow the guidance in Cursor's security notice. [1]

Large enterprise

A security operations team

What to know

Cursor says the extension was reachable through its marketplace on October 29, and Socket says up to 5,000 users could be affected, so developer endpoints are the exposure to scope. [1][2]

What to do

  1. Query endpoint inventory and extension telemetry for Claude Code extension version 2.1.313 in Cursor. [1][2]
  2. Hunt on affected hosts for new or unexpected SSH access and persistence, based on the reported SSH backdoor. [3]
  3. Apply the remediation steps in Cursor's security notice and open incident response for confirmed installs. [1]

Sources

  1. [1]Cursor Blog (community feed) · Oct 29, 12:00 UTC
    Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplacecontext
  2. [2]Socket Blog · Oct 30, 09:26 UTC
    Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplacecontext
  3. [3]The Hacker News · Oct 30, 08:55 UTC
    Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoorcontext