Malicious Claude Code extension slipped into Cursor's marketplace for eleven hours

What happened

On October 29, 2026, a malicious package posing as Anthropic's Claude Code extension was available in Cursor's VS Code extension marketplace for roughly eleven hours, from about 2:27 a.m. to 1:35 p.m. Pacific Time. According to a write-up on dev.to summarizing Cursor's incident notice, the package carried the identifier anthropic.claude-code and the version number 2.1.313, but Cursor says the build was not developed by Anthropic, and that it has no evidence other versions or the official distribution channels were affected.

Cursor estimated that at most 5,000 users installed the package during the exposure window.

What the malicious build did

The extension attempted to fingerprint the machines it landed on, collecting the hostname, username, operating system, architecture, home and working directories, the configured Git email address, the public IP address, and the names of environment variables. It then tried to plant an attacker-controlled SSH key, labeled svc-telemetry, in the user's authorized_keys file, enable the local SSH service, and open a persistent reverse tunnel back to the attacker.

One qualification limits the damage: turning on the SSH service required administrator rights, so that particular step would fail on most macOS and Windows machines. The remaining actions could still execute. Cursor says the attacker's server is now offline, and it recommends remediation for anyone who installed the affected version from its marketplace during the window.

A correction about the distribution path

Early alerts attributed the malicious package to Open VSX. As the dev.to article recounts, researchers later revised their reporting after Cursor clarified that the package appeared in Cursor's own extension marketplace, and that version 2.1.313 was not present in Open VSX, Microsoft's Visual Studio Marketplace, or the npm distribution of Claude Code.

The correction matters because an extension's name and version string alone do not establish which registry delivered a particular file. Editors can pull from different marketplaces and mirrors, and two listings that look identical in a search result can be different artifacts.

What remains unknown

Cursor's notice documents its response, which included removing the package, auditing the marketplace, and rotating keys, but it does not explain how the malicious build entered the marketplace or who was behind it. Cursor says it found no evidence that any other extension was tampered with. The dev.to piece cautions against reading more into the incident than the evidence supports: there is no public basis for claims of an Anthropic build-system compromise, a confirmed account takeover, or a flaw in Claude Code itself.

If you may have installed it

The advisory applies to installations from Cursor's marketplace during the stated window, and the svc-telemetry key in authorized_keys is the primary indicator on macOS and Windows. Cursor warns that removing the extension alone does not guarantee cleanup, because persistence mechanisms such as launch agents, scheduled tasks, the rogue SSH key, and running tunnel processes can survive an uninstall. Its notice includes platform-specific checks and remediation scripts.

Where there is evidence the payload actually executed, Cursor recommends treating it as a full incident rather than a reinstall: isolate the host, strip out persistence and tunnel processes, weigh a rebuild, and rotate credentials and sessions reachable from the machine, doing so from a trusted system. Organizations should preserve logs and images before cleanup where policy requires it.

Why it matters

The incident underlines that editor extension stores are a genuine supply-chain link, not just a place to browse add-ons: a familiar brand, a plausible version number, and a marketplace listing were enough to deliver malware to thousands of developers. Trust attaches to the specific marketplace that delivered the file, not to the extension's name, a distinction the earliest reporting about Open VSX got wrong. For teams, the practical lessons are to record exactly which editor, registry, publisher, version, and install time produced each artifact, and to control extension installs on managed machines through allowlists or approved-version policies rather than relying on the update button. The next malicious package may not stay live for only eleven hours.