Cursor reports that a maliciously modified Anthropic.claude-code extension, version 2.1.313, reached users through its VS Code extension marketplace. The October 29 security notice says the package was available that day from approximately 2:27 a.m. to 1:35 p.m. Pacific time. Cursor says at most 5,000 users were affected and will contact them directly.

Evidence status: vendor-reported malicious package distribution and payload analysis. This was an actual supply-chain incident, rather than a hypothetical demonstration. The user estimate does not establish how many attackers successfully logged into, or stole credentials from, affected machines.

Cursor says Anthropic did not develop the malicious version. It reports no evidence that other extension versions or the official distribution were affected. The notice supplies separate package hashes for macOS darwin-arm64 and Windows win32-x64.

The payload tried to leave access behind

According to Cursor, the extension collected host and user information, including the configured Git email, working directories and environment-variable names. That last item describes names, not a finding that every variable’s secret value was collected.

The payload also attempted to add an attacker-controlled SSH key, enable the computer’s SSH service and create a reverse tunnel. SSH is a remote-login service; the tunnel attempted to give the attacker a route back to it. Startup mechanisms were intended to keep retrying after the extension stopped running.

Cursor says privilege requirements and errors in the malicious code prevented the login path from working on most ordinary macOS and Windows setups. Its notice nevertheless warns that key installation, persistence and host-information reporting still occurred. A failed attempt to enable remote login does not remove those changes.

Cursor reports removing the package, temporarily shutting down and rebuilding its marketplace, rotating its keys, and auditing other extensions. It says the attacker’s hosting provider took the server offline. Those measures interrupt distribution and that server’s operation; they do not clean an affected computer.

Check the installation history and investigate affected hosts

The exposure condition is installing or updating to that package from Cursor’s marketplace during the stated window. Merely using Claude Code elsewhere does not establish exposure to this package.

Cursor’s response guidance calls for:

  1. Reviewing extension-installation history and endpoint and network records against the notice’s package hashes and indicators. Investigate evidence of execution as well as the current installed version.
  2. Isolating hosts with evidence of payload execution or backdoor installation. Preserve relevant records for the investigation.
  3. Removing unauthorized keys, startup persistence and running tunnel processes, then assessing whether to rebuild the host. Uninstalling the extension alone can leave standalone scripts behind.
  4. Rotating credentials and sessions accessible from affected hosts, using a trusted system. Limited initial collection does not rule out later access if the backdoor worked.

The notice links platform-specific cleanup scripts and documents their required privileges. Review that official guidance before using them; an extension update is not a substitute for host cleanup.

One missing indicator cannot establish a clean machine

The notice identifies an unauthorized key labeled svc-telemetry, a macOS LaunchAgent named com.apple.sysmond, and a Windows scheduled task named SysMon. It also describes a Windows startup-script fallback. These are investigation leads; compare the complete indicators and package hashes in the source.

Its quick key check prints a reassuring result when that label is absent. That single absence cannot rule out earlier execution, removed evidence or a different persistence artifact. Installation records and the rest of the documented indicators still matter.

Caveat: Cursor is the affected marketplace operator and supplies the analysis. The reviewed notice leaves the initial marketplace entry point and the extent of successful attacker access unresolved.