Oleksandr Kuzmenko, EditorPublished 5 min readAI-assisted · editor-reviewed
TL;DR
- Cursor confirmed a malicious Claude Code 2.1.313 package was distributed via its custom extension marketplace on October 29.
- The backdoor targeted macOS and Windows, attempting unauthorized SSH key injection and reverse tunnels.
- Open VSX and npm audit logs show no records of 2.1.313 ever being published or removed from those registries.
Key facts
- Affected Extension Version
- 2.1.313
- Potential Users Exposed
- Up to 5,000 (vendor-confirmed)
- Incident Date
- October 29, 2026
- Neighboring Releases in Open VSX
- 2.1.312 and 2.1.314
Source: Key facts — Affected Extension Version
Source: Key facts. Affected Extension Version: 2.1.313. Each figure is copied from the story.
- Affected Extension Version2.1.313
Distribution Vectors and Forensic Analysis
Initial alerts pointed to Open VSX and npm, but Socket analyzed 3,392 change events between October 27 and October 30. The Open VSX append-only change feed preserved neighbor releases (2.1.312 and 2.1.314 across all eight platform targets) along with 42 deleted versions from other extensions, but recorded no entries for 2.1.313. Official Anthropic npm metadata for @anthropic-ai/claude-code also lacked any publication or unpublish timestamp for version 2.1.313.
The Cursor Marketplace Incident
Cursor confirmed the package was distributed directly through its custom marketplace catalog on October 29, potentially affecting up to 5,000 users. The rogue extension contained macOS and Windows payloads designed to insert unauthorized SSH keys, initiate a reverse SSH tunnel, and configure background persistence. Cursor remediated the threat by rotating marketplace keys, rebuilding infrastructure, neutralizing the attacker server, and publishing indicators of compromise.
Try it in 2 minutes
npm view @anthropic-ai/claude-code time --jsonWhen to use
- Inspect local SSH configurations and run vendor IOC remediation if Claude Code was installed inside Cursor on October 29.
When NOT to use
- Do not download extensions from third-party catalogs without verifying repository provenance and signing hashes.
What to do today
- Check developer machines for Cursor installations or updates performed on October 29.
- Audit authorized_keys files and system background services for unauthorized SSH keys or persistence artifacts.
- Run Cursor's published remediation scripts and verify host logs against provided IOCs.
Step names are taken from What to do today.
Step names are taken from What to do today. Check developer machines for Cursor installations or updates performed on October 29.. Audit authorized_keys files and system background services for unauthorized SSH keys or persistence artifacts.. Run Cursor's published remediation scripts and verify host logs against provided IOCs.
- Check developer machines for Cursor installations or updates performed on October 29.
- Audit authorized_keys files and system background services for unauthorized SSH keys or persistence artifacts.
- Run Cursor's published remediation scripts and verify host logs against provided IOCs.