Cursor flags malicious Claude Code extension

The company estimates that up to 5,000 users may have been affected, but did not say how many installed the tampered package.

The code tried to collect data from the environment and maintain remote access via SSH. Cursor says the version was not developed by Anthropic, that it removed the package and that it found no evidence of compromise of other extensions.

What it is: a package distribution incident in a marketplace. What it is not: a confirmed failure in all versions of Claude Code or an announcement of a new model.

In this article you will see:

• Which package was affected and the period it was available.
• What type of malicious activity Cursor identified.
• How to check for possible impact and respond safely.
• What the case reveals about code agent extensions.

The version 2.1.313 appeared in Cursor's marketplace

Cursor's notice was published on October 29. The company identified an altered version of the extension called Anthropic.claude-code, number 2.1.313, available in its extensions marketplace for VS Code.

The publication defines the exposure window: the version was available between 2:27 and 13:35, Pacific time, on October 29.

To assess risk, cross check the installed version with the download source and this window. The statement does not point to a general problem in Claude Code.

Cursor explicitly states that the malicious extension was not developed by Anthropic. It also says it has no evidence that other versions of the package or the official distribution of Claude Code were affected.

The estimate of up to 5,000 users is an upper limit disclosed by Cursor, not a confirmed count of installations or compromised computers.

The company said it would contact possibly affected users directly.

The official Claude Code site presents Anthropic's product. This reference helps separate the legitimate tool from the specific package that Cursor removed from its own marketplace.

The package tried to collect information and maintain remote access

According to Cursor, the code collected information about the computer and user: machine name, username, operating system, architecture and home folder.

It also collected names of environment variables, working directories, email address configured in Git and public IP address.

Cursor reported attempts to insert an SSH key controlled by the attacker into the authorized keys file and to enable the local SSH service.

SSH allows remote access. A reverse tunnel can create a connection path back to the exposed machine.

The package tried to maintain activity after installation. On macOS, it used a LaunchAgent; on Windows, it tried to create a scheduled task and a startup item.

Therefore, removing only the extension may not clean up files it already left on the computer.

Cursor says the attack server was taken offline with help from the hosting provider. This interrupted communication with that server, but does not prove computers are clean.

An attempt at remote access also does not prove the attacker succeeded.

Enabling the SSH service required administrative privileges. According to Cursor, this step would fail on most macOS and Windows computers due to errors in the code.

The company still recommends checking and performing remediation, as the key and persistence mechanisms could have been written.

How to verify the installation and respond to the incident

Start by confirming whether the installed version was exactly 2.1.313 and whether the download came from the Cursor marketplace during the indicated window. An installation outside that context, by itself, does not match the scenario described in the warning.

Cursor points svc-telemetry as the identifier of the unauthorized key that the package tried to insert into authorized SSH files.

The company recommends looking for that marker and reviewing the other indicators in the official notice.

If there are signs of execution, treat the computer as potentially exposed. Isolate it from the network according to the incident response process.

Do not rely only on uninstalling the extension to remove possible persistent files.

Cursor published procedures and remediation scripts for macOS and Windows in the official notice.

Download the files directly from the incident page, follow the instructions for your system and validate the result before returning the machine to work.

The company recommends changing, from a trusted device, credentials and sessions accessible on the affected machine.

The notice says there was collection of environment variable names, not their values. Still, the attempt at persistent access justifies precaution.

The incident does not prove a flaw in official Claude Code

It is important to attribute each fact to the correct package and environment. Cursor reported a tampered extension hosted on its marketplace.

It did not attribute the malicious code to Anthropic nor announce a compromise of the official Claude Code distribution.

Cursor's response was specific: it removed the version, blocked its distribution, audited access and said it found no other tampered extensions.

The company shut down the marketplace as a precaution, rotated keys, rebuilt the service and brought it back online.

This does not eliminate the need to verify machines that installed the suspicious version. "No evidence of another affected version" does not mean "no user was impacted".

Cursor disclosed a ceiling of potentially exposed users, not a final result of individual investigation.

The episode shows why name, icon and description are not enough to authenticate an extension.

For those installing code agents, it is worth checking the publisher, the version, the package origin and the update time. This matters especially when the tool reads files and executes processes in the development environment.

If you are starting out, check our guide to install and use Claude Code in VS Code.

The comparison of Codex, Copilot and Claude Code also helps distinguish the tools and their installation channels.