[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9QM5Q-UUsqlLZd5dj1pfZCP_SNB0pfH1rsgaVgzq2fw":3},{"article":4,"iocs":53,"watch_terms":57,"solutions":58,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"e1186e8e-c852-4ffc-9a76-7d673a1b5e6e","Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace","cursor-removes-malicious-claude-code-2-1-313-extension-from-its-marketplace-4fb089","Cursor has confirmed that a malicious Claude Code extension labeled version 2.1.313 was available through its extension marketplace on October 29, potentially affecting up to 5,000 users. The disclosure identifies the distribution source behind a malware report initially attributed to Open VSX, where Socket’s investigation found no corresponding publication or removal records. OpenSourceMalware initially reported that a malicious version of Anthropic’s Claude Code extension, 2.1.313, was published to the Open VSX registry. The analysis, written by Paul McCarty, described an unpacked macOS extension containing code that adds an SSH authorized key, attempts to establish a reverse SSH tunnel, and installs persistence. That article has since been substantially revised and no longer identifies Open VSX as the affected distribution channel. The report also stated: “The provenance of the analyzed directory is not established.” It acknowledged that its findings do not independently demonstrate a compromise of Anthropic’s official distribution infrastructure. Socket has not obtained and analyzed the reported artifact. OpenSourceMalware co-founder Jenn Gile’s initial LinkedIn post identified npm and Microsoft’s VS Code Marketplace as affected distribution channels. Cursor later confirmed distribution through its own marketplace. Socket continuously monitors npm, Open VSX, and the VS Code Marketplace and automatically ingests newly published packages and extensions. Our ingestion systems did not capture version 2.1.313 from any of those registries, prompting us to investigate whether it had been publicly available. Our review of registry records and its own ingestion logs has found no evidence that Claude Code version 2.1.313 became publicly available through Open VSX during the period examined. The version is also absent from the npm package’s current version and publication-time records. These findings challenge reports that a malicious official release was briefly distributed and then removed. Open VSX’s public change feed records the neighboring releases, including all eight platform builds of each, but contains no publication or removal event for 2.1.313 in the window we reviewed. Public distribution of the reported artifact remains unsubstantiated. Open VSX Has No Publication Record for 2.1.313 # Open VSX provides a registry changes feed designed to track versions becoming available, being deactivated, and being removed. Its append-only history is intended to retain events even after a version is deleted or purged. We examined 3,392 returned events beginning October 27, 2026. The latest event in that completed review was timestamped October 30 at 05:35:23 UTC. The results included: ACTIVE events for all eight platform builds of 2.1.312. ACTIVE events for all eight platform builds of 2.1.314. No events for 2.1.313. Under the documented behavior, a version becoming publicly available and subsequently being removed should leave a history. Its absence weighs against the explanation that 2.1.313 was simply published and quickly pulled. Between October 27 and October 30 at 05:35 UTC, the same feed recorded 42 versions across 21 other extensions that were published and subsequently removed. Every version retained both events, including one removed approximately 90 seconds after publication. No corresponding publication or removal event appeared for Claude Code 2.1.313. These observed removals show that even briefly available versions ordinarily leave a record. We found no such record for 2.1.313. Polling alone cannot exclude every short-lived event, which is why the registry’s retained change history is significant. npm records also skip 2.1.313 We queried the npm registry metadata for @anthropic-ai\u002Fclaude-code. Version 2.1.313 was absent from both the versions object and the time map. npm’s metadata retains publication timestamps for unpublished versions in the package’s time record. For example, the malicious Axios releases 1.14.1 and 0.30.4 were removed following the March 2026 compromise, but their publication timestamps remain visible: npm view axios time --json | grep -E '\"(1\\.14\\.1|0\\.30\\.4)\"' The absence of 2.1.313 from Claude Code’s time record therefore weighs against the explanation that it was published to npm and quickly removed. The adjacent entries were: Version Publication time in UTC 2.1.312 October 27, 2026, 18:36:10 2.1.314 October 30, 2026, 00:12:56 This provides no support for a malicious npm release at 2.1.313. We are not treating absence from the current registry response as an absolute guarantee that no administrative action or attempted publication occurred. The public GitHub releases and changelog likewise skip 2.1.313. The 2.1.314 changelog we reviewed contains no explanation of the missing version or notice of this reported incident. A skipped number is not, by itself, evidence of a security event. Within the range 2.1.260 through 2.1.314, the current npm and Open VSX catalogs also omit 2.1.262, 2.1.264, 2.1.279, 2.1.297, and 2.1.298. Those gaps do not establish what happened to any particular build. The screenshot does not establish the download history # The initial report’s screenshot shows 2.1.313 selected as latest, with a “Published 3 hours ago” label. The post displays a cropped version; the full-size original also shows the \"Target Platforms\" panel. It displays Linux and Windows download sizesthat match the public 2.1.314 builds at the displayed precision. Platform Screenshot labeled 2.1.313 Public 2.1.314 build Linux x64 135.13 MB 135.13 MB Windows x64 136.07 MB 136.07 MB We checked these against the 2.1.314 registry metadata and download lengths. Open VSX’s interface rounds file sizes to two decimal places, so matching displayed sizes do not prove identical files or screenshot manipulation. The analyzed sample is also described as a macOS build, while the fully visible sizes above concern other platforms. Screenshot published by OpenSourceMalware showing Claude Code 2.1.313 labeled as the latest release on Open VSX. Its displayed Linux and Windows download sizes match version 2.1.314. The relative publication label does not establish three hours of continuous public availability. Open VSX distinguishes a version’s original timestamp from its availability transitions. The screenshot raised questions about whether it documented an actual public listing. It shows 2.1.313 as the latest release, but its displayed Linux and Windows download sizes match 2.1.314, and we found no corresponding publication event in Open VSX’s change feed. These discrepancies led us to suspect the image was edited or created for illustrative purposes. It has since been removed. Cursor Publishes Remediation Guidance # Cursor’s security notice identifies the affected version, provides hashes for the malicious macOS and Windows packages, and includes indicators of compromise and remediation scripts. Cursor says it removed the extension, rebuilt its marketplace after rotating keys, and worked with the hosting provider to take the attacker’s server offline. It is contacting affected users directly. For organizations assessing exposure, the key question is whether developers installed or updated the extension through Cursor’s marketplace during the affected window. Socket’s investigation found no corresponding publication or removal records for 2.1.313 in Open VSX, and no entry in npm’s publication history. Cursor’s confirmation establishes a separate distribution path and gives security teams a specific marketplace, version, and installation window to investigate.","Cursor confirmed removal of a malicious Claude Code extension version 2.1.313 from its marketplace on October 29, potentially impacting up to 5,000 users. The extension contained code to add SSH authorized keys, establish reverse SSH tunnels, and install persistence mechanisms. Socket's investigation found no corresponding publication or removal records in Open VSX or npm registries, contradicting initial reports about the malware's distribution channels.","Cursor removed malicious Claude Code 2.1.313 extension from its marketplace affecting up to 5,000 users.","https:\u002F\u002Fsocket.dev\u002Fblog\u002Fclaude-code-extension-compromise?utm_medium=feed","https:\u002F\u002Fcdn.sanity.io\u002Fimages\u002Fcgdhsj6q\u002Fproduction\u002F5c7f09a921c3fe21434d6bcfc7acfcceaf0ffa38-1672x941.png?w=1000&q=95&fit=max&auto=format","2026-10-30T09:26:06.05+00:00","2026-10-30T11:00:08.61785+00:00",7,[17,20,22,25,27,30],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":19},"Cursor",{"name":23,"type":24},"Anthropic","vendor",{"name":26,"type":24},"Microsoft",{"name":28,"type":29},"VS Code Marketplace","technology",{"name":31,"type":29},"Open VSX","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":42,"value":55,"context":56},"Claude Code 2.1.313","Malicious extension version containing SSH key injection, reverse SSH tunnel, and persistence installation code",[26,23,18],{"controls":59,"vendors":144},[60,89,117],{"slug":61,"name":62,"problem":63,"products":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"slug":52,"name":90,"problem":91,"products":92},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":118,"name":119,"problem":120,"products":121},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":140,"url":142,"description":143},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[145],{"slug":139,"name":140,"logo_path":141,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"malicious-cursor-marketplace-extension-backdoors-up-to-5000-developer-systems","Malicious Cursor Marketplace Extension Backdoors Up to 5,000 Developer Systems","A trojanized Claude Code extension (v2.1.313) was distributed through Cursor's marketplace, embedding SSH key injection, reverse tunnel establishment, and persistence mechanisms — classic supply chain attack hallmarks targeting developer tooling. The incident exposes how extension marketplaces can become high-value attack vectors when publisher identity verification and code vetting are insufficient. Developers inherently trust marketplace listings, making malicious packages particularly dangerous as they execute with user-level or elevated permissions. The discrepancy between Cursor's marketplace records and Open VSX\u002Fnpm registries also highlights a monitoring gap that delayed detection and complicated attribution.",[153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":161,"MITRE ATT&CK T1566: Phishing":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"CIS Control 17: Incident Response Management":164,"OWASP A06:2021 Vulnerable and Outdated Components":165,"CIS Control 7: Continuous Vulnerability Management":166,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":167},"NIS2 mandates supply chain security measures including assessment of third-party software integrity, which would require marketplace operators like Cursor to implement publisher verification and code review controls.","Distributing a trojanized package through a trusted marketplace mirrors phishing logic — abusing an inherently trusted channel — and ATT&CK's supply chain compromise techniques (T1195) map directly to this delivery method.","SI-2 requires organizations to identify and remediate flawed or malicious software components promptly, which would mandate rapid detection and removal processes for compromised marketplace extensions.","The confusion around distribution channels and delayed attribution underscores the need for a tested incident response plan that includes supply chain compromise scenarios and cross-platform registry reconciliation steps.","This attack exploited blind trust in marketplace-distributed components; vetting third-party extensions for malicious code is exactly the risk A06 addresses in software supply chains.","Regular automated scanning of installed software — including IDE extensions — against known-malicious package signatures would have flagged version 2.1.313 before widespread installation.","A.8.8 requires organizations to track and respond to vulnerabilities in software they operate or distribute, directly applicable to marketplace operators vetting extensions before publication."]