The facts
The affected package identifies itself as Anthropic.claude-code version 2.1.313. Cursor gives an exposure window of about 02:27–13:35 Pacific time on 29 October, or 09:27–20:35 UTC. [1]
Cursor says Anthropic did not develop the malicious version. Researchers corrected their initial Open VSX attribution; the identified distribution incident concerns Cursor's marketplace. [1][2][3]
The malware attempted persistent SSH access and collected host information. Cursor says the remote-login step generally failed on ordinary macOS and Windows installations without administrator rights, while SSH-key changes, persistence and host-data transmission could still occur. [1][2]
Cursor says it removed the package, audited the marketplace, rotated keys and restored the service. It also worked with the hosting provider to disable the attack server. [1]
The company advises affected users to isolate compromised hosts, remove unauthorized persistence and rotate accessible credentials from a trusted system. It warns that uninstalling the extension alone may be insufficient; its notice provides the remediation guidance. [1]
Still unconfirmed
- How the modified package entered the marketplace, the final affected total and any subsequent credential access or other victim activity remain unresolved.
Sources
References support the numbered facts above. Source checks: 30 Oct 2026, 11:31 UTC.
- Security notice for modified Claude Code extension 2.1.313
Cursor · Primary source · 29 Oct 2026
Actual operator notice and relevant response/remediation sections read. The affected-user ceiling and service actions are company accounts; the admin-rights limitation does not establish every endpoint is clean. Source scripts were not executed.
- Analysis of the trojanized Claude Code extension
OpenSourceMalware · Primary source · 30 Oct 2026
Actual technical report and corrected distribution attribution read. Independent research organization from Cursor; its artifact analysis is not complete telemetry for all affected users. No payload or remediation code executed.
- Reporting on the Claude Code marketplace compromise
The Hacker News · Reporting · 30 Oct 2026
Actual updated report read. Separate newsroom from the vendor/researcher; it quotes their evidence. Earlier Open VSX attribution is corrected in the report and is not adopted.