Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace · Cursor

cursor.com5 min read

Cursor identified a malicious version of the Anthropic.claude-code extension in its marketplace that attempted to install a persistent SSH backdoor on macOS and Windows systems. The unauthorized packages were available for a limited time before Cursor removed them, shut down the marketplace temporarily, and released remediation scripts. Cursor reports that the attacker server has been taken offline and urges affected users to run validation and remediation steps. Open article →

More on this topic

Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplacesocket.devOct 30, 20265 min
Trojanized Claude Code Extension Plants an SSH Backdooropensourcemalware.comOct 30, 20266 min
Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machinesstepsecurity.ioOct 30, 20263 min
Know Your AI Toolchain: Lessons from the Cursor Marketplace Incidentblog.kilo.aiOct 30, 20263 min
Anthropic VS code extension on Cursor backdoored for nearly 12 hoursarstechnica.comOct 30, 20261 min
Malicious Claude Code extension on Cursor planted SSH backdoorsbleepingcomputer.comOct 30, 20263 min
Anthropic: That Claude Code extension compromise… couldn't be ustheregister.comOct 30, 20262 min
Devs Hit by Trojanized Claude Code Extension for Cursordarkreading.comOct 30, 20263 min
Closing the Tunnel: Santa and Workshop vs. the Claude Code Extension Backdoornorthpole.securityOct 30, 202613 min
Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoorthehackernews.comOct 30, 20262 min
Anthropic hacked to deliver remote access trojan to Claude developer laptops worldwidedoublepulsar.comOct 30, 20261 min
A Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of Deviceswired.comOct 30, 20261 min
detect-compromised-claude-vscode-extension-macos-2026-10-26gist.github.comOct 30, 20261 min
Malicious Claude Code Extension (2.1.313) in Cursor Marketplace Plants Attacker SSH Key and Persistenceox.securityOct 30, 20265 min
Official Claude Code Extension Compromise: Security Advisory | Phorionphorion.ioOct 30, 202612 min
Malicious Claude Code extension distributed through Cursor marketplacesophos.comOct 30, 20261 min
Hackers hijacked a Claude Code extension, exposing yet another new AI security riskfastcompany.comOct 30, 20262 min
Claude Code extension poisoned with persistent SSH backdoorhelpnetsecurity.comOct 30, 20261 min
Fake Claude Code extensions in Cursor: Malicious activity after the exposure windowexpel.comOct 30, 20268 min
Reported SSH Backdoor in Claude Code Extension Served Through Cursorrietta.comOct 30, 20262 min
Cursor Confirms Anthropic Claude Code Extension Compromisedbankinfosecurity.comOct 30, 20263 min
Malicious Claude Code extension in Cursor's marketplace attempted remote access and data theftthe-decoder.comOct 30, 20261 min
The backdoored Claude Code 2.1.313 build in Cursor's…theainewsreport.comOct 30, 20268 min
Trusted Tool, Malicious Build: What the Trojanized Claude Code Extension Means for Developer Endpointsmorphisec.comOct 30, 20264 min
Backdoors in official Claude Code extensionscyberplace.socialOct 30, 20262 min