Brendan Chamberlain

Cursor users: check your Claude Code extension. Cursor confirms a trojanized Anthropic.claude-code v2.1.313 in its extension marketplace on 29 October, 09:27 to 20:35 UTC. It estimates up to 5,000 affected users and identifies macOS ARM64 and Windows x64 builds. Loading the extension executes malicious code that collects host information and attempts to install a persistent SSH backdoor. Cursor says SSH access would fail on most hosts due to bugs and insufficient privileges. That limits remote access; it doesn’t undo malicious code execution. Credentials and repositories accessible to that account are potentially at risk. The package has been removed and the C2 taken offline. Uninstalling the extension may still leave persistence behind. If this version ran, investigate the host, remove persistence and rotate accessible credentials from a clean system. Updating the extension alone doesn’t prove the machine is clean. The vendor-confirmed distribution channel is Cursor’s marketplace. Microsoft VS Code uses a separate store. These reports don’t establish a compromised Microsoft Marketplace or malicious npm release. My recommendation: turn off automatic extension updates completely - for yourself and for your developers. With supply chain attacks like this, I don’t think the benefit of another feature or a minor UI fix justifies automatically accepting every new release onto developer machines. Update manually when something stops working, when a bug is actually getting in your way, or when a relevant security fix needs to be applied. Otherwise, leave a working extension alone. Cursor advisory and cleanup instructions: cursor.com/blog/claude-code-… Technical analysis: opensourcemalware.com/blog/t…