Tampered Claude Code extension sat in Cursor's marketplace for about 11 hours
Developers who installed it should remove it and check for leftover persistence scripts and SSH keys, not just uninstall it.
A tampered copy of Anthropic's Claude Code extension was briefly available in Cursor's extension marketplace, live for about 11 hours after the October 29 incident, in versions 2.1.312 and 2.1.313. The modified code, aimed at macOS and Windows, ran on module load to gather host details and try to open a reverse SSH tunnel with persistence. Security researcher Kevin Beaumont estimates roughly 5,000 developer systems may have downloaded it. Anthropic says it did not build or publish the copies, that they never reached its other marketplaces or npm, and it shipped version 2.1.314 directly to avoid confusion. Cursor removed the extension, suspended and rebuilt its marketplace, rotated keys, and had the attacker's server taken offline. Its reported checks found no other malicious extensions, and because enabling SSH needs admin rights, the tunnel step likely failed on most systems. Users should remove the extension and check for leftover persistence scripts and SSH keys, since uninstalling alone may not be enough.
Why it matters
The incident shows that an extension marketplace can carry a malicious build of a trusted tool even when the original publisher's own channels are clean. Anthropic said the copies never reached its other marketplaces or npm and that only Cursor users were affected, so the exposure is limited to Cursor's marketplace. Cursor's own guidance that uninstalling may not be enough means the cleanup is not finished for anyone who ran the extension, even though the tunnel step likely failed on most machines.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.