Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
Cursor removed malicious Claude Code 2.1.313 extension from its marketplace affecting up to 5,000 users.
Cursor confirmed removal of a malicious Claude Code extension version 2.1.313 from its marketplace on October 29, potentially impacting up to 5,000 users. The extension contained code to add SSH authorized keys, establish reverse SSH tunnels, and install persistence mechanisms. Socket's investigation found no corresponding publication or removal records in Open VSX or npm registries, contradicting initial reports about the malware's distribution channels.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA trojanized Claude Code extension (v2.1.313) was distributed through Cursor's marketplace, embedding SSH key injection, reverse tunnel establishment, and persistence mechanisms — classic supply chain attack hallmarks targeting developer tooling. The incident exposes how extension marketplaces can become high-value attack vectors when publisher identity verification and code vetting are insufficient. Developers inherently trust marketplace listings, making malicious packages particularly dangerous as they execute with user-level or elevated permissions. The discrepancy between Cursor's marketplace records and Open VSX/npm registries also highlights a monitoring gap that delayed detection and complicated attribution.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Claude Code 2.1.313