Threat
Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace
First reported · Discovered socket.dev
Page published · Page updated
Earliest dated coverage: 30 Oct 2026 · First observed: 4 Nov 2026 · Latest dated coverage: 30 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
The malicious Claude Code 2.1.313 extension highlights supply-chain exposure in AI coding-tool marketplaces and warrants checking installed extensions for the affected version.
Cursor removed a malicious Claude Code 2.1.313 extension from its marketplace, according to Socket. The provided excerpt does not establish the payload, installation scope, or whether users were compromised.
Summary
Socket reports that Cursor confirmed distribution of a malicious Claude Code extension labeled version 2.1.313 through its own extension marketplace on October 29, 2026. Cursor placed the potentially affected population at no more than 5,000 users; this is an exposure ceiling, not a demonstrated count of successfully backdoored systems. The confirmed distribution path is Cursor's marketplace, not a verified malicious release through Anthropic's official distribution infrastructure.[0]
An Anthropic representative quoted in the article said a malicious actor used access to Cursor's marketplace to publish a tampered copy that Anthropic neither built nor published. The representative denied compromise of Anthropic's systems or employee laptops. The supplied evidence does not identify the attacker or explain how marketplace access was obtained.[0]
The reported payload behavior comes from OpenSourceMalware's examination of an unpacked macOS extension: code added an SSH authorized key, attempted a reverse SSH tunnel, and installed persistence. These findings require a provenance caveat. The originating analysis acknowledged that the directory's provenance was not established, and Socket had not obtained or independently analyzed the artifact. The supplied evidence therefore does not independently connect those observed code contents to a verified marketplace download or establish successful execution on affected endpoints.[0]
Socket's registry investigation challenged the initial attribution to Open VSX and npm. Its reviewed Open VSX change history contained neighboring releases but no publication or removal event for 2.1.313, while npm metadata lacked that version in both its version catalog and publication-time records. These findings weigh against the initially claimed distribution routes within the reviewed evidence; they do not constitute an absolute exclusion of every possible administrative event. Cursor's confirmation establishes a separate distribution route.[0]
Cursor reportedly removed the extension, rotated keys, rebuilt its marketplace, coordinated removal of the attacker's server, and began contacting affected users. Its security notice reportedly includes package hashes, indicators, and remediation scripts. Defender scoping should center on the extension's version, Cursor marketplace provenance, and the reported availability window, while keeping confirmed distribution separate from the less-certain artifact analysis.[0]
Attack chain
- Distribution through Cursor's marketplace: According to Cursor's confirmation and the Anthropic statement reproduced by Socket, an attacker used access to Cursor's marketplace to publish a tampered Claude Code extension labeled 2.1.313. It was available on October 29, 2026. The evidence does not explain how the attacker obtained that access or identify a specific vulnerability used to do so.[0]
- Reported SSH backdoor and persistence capabilities: OpenSourceMalware reportedly found code in an unpacked macOS extension that adds an SSH authorized key, attempts to establish a reverse SSH tunnel, and installs persistence. These are reported payload capabilities, not independently verified endpoint outcomes. The directory's provenance was unresolved, Socket had not analyzed the artifact, and the supplied evidence does not establish an execution trigger or ordering among these behaviors.[0]
Disclosure timeline
| Date | Event |
|---|---|
| 2026-10-29 | The malicious Claude Code extension labeled 2.1.313 was available through Cursor's marketplace, according to Cursor's confirmation as reported by Socket.[0] |
| 2026-10-30T05:35:23Z | This was the timestamp of the latest event in Socket's completed Open VSX change-feed review. The review covered 3,392 returned events beginning October 27 and found no publication or removal event for 2.1.313.[0] |
| 2026-10-30 | Socket published its account of Cursor's confirmation, the disputed distribution claims, and Cursor's reported containment and remediation measures. Separate timestamps for the removal, key rotation, marketplace rebuild, and server takedown are not supplied.[0] |
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Claude Code extension distributed through Cursor's IDE extension marketplace | Malicious copy labeled version 2.1.313, available on October 29, 2026, with at most 5,000 users potentially affected according to Cursor. Socket says Cursor's notice supplies hashes for malicious macOS and Windows packages; the supplied text does not enumerate those hashes or establish equivalent payload behavior across platforms. | Cursor reportedly removed the malicious extension, rotated keys, and rebuilt its marketplace. No specific clean replacement version is identified in the supplied evidence. The neighboring 2.1.314 release should not be treated as a documented remediation version on this evidence alone.[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| other | 2.1.313 | Version label of the malicious Claude Code extension reported in Cursor's marketplace. Actionable as an inventory-hunting identifier when paired with the extension identity and marketplace provenance; it is not a file hash or proof of successful payload execution.[0] |
Key takeaways
- Distribution provenance is the central scoping fact: Cursor's marketplace is the confirmed route reported in the evidence, while the initial Open VSX and npm claims were not supported by Socket's reviewed registry records.[0]
- Separate three evidentiary levels: confirmed malicious-extension availability, reported backdoor capabilities in a provenance-unresolved sample, and successful endpoint compromise. The supplied evidence does not establish the third for every potentially affected user.[0]
- Neither a skipped release number nor the disputed screenshot establishes publication history. The screenshot's matching rounded package sizes also do not prove identical files or image manipulation.[0]
- The available report supports targeted exposure assessment and use of Cursor's incident-specific indicators and remediation material, but not named-actor attribution, an identified vulnerability, or a claim that Anthropic's official release infrastructure was compromised.[0]
Defensive actions
- Review developer extension inventories and installation or update records for Claude Code 2.1.313 obtained through Cursor's marketplace, focusing on the reported October 29 availability.: Cursor's confirmation supplies a specific marketplace, version label, and date for exposure assessment. The maximum of 5,000 potentially affected users does not identify which endpoints installed or executed the malicious extension.[0]
- Use the malicious macOS and Windows package hashes and other indicators in Cursor's security notice to validate suspected installations.: Socket reports that the notice contains package-level indicators. They provide a verification path beyond the version label, but their literal values are absent from the supplied evidence and cannot be reproduced here.[0]
- Consult Cursor's incident-specific remediation scripts and investigate the reported SSH authorized-key, reverse-tunnel, and persistence behaviors on suspected affected systems.: Cursor reportedly published remediation scripts, while the originating macOS analysis described these backdoor capabilities. Their presence on an endpoint would require investigation; the supplied evidence does not establish that every exposed installation executed them or provide the scripts' contents.[0]
- Keep marketplace provenance explicit in incident scoping and communications; do not classify npm or Open VSX installations as affected solely because version 2.1.313 is missing from their catalogs.: Socket found no corresponding Open VSX publication or removal events and no npm publication-time entry during its review. It also documented other skipped version numbers and cautioned that a numbering gap alone is not evidence of a security event.[0]