Cursor Confirms Malicious Claude Code 2.1.313 Extension Was Available in Its Marketplace

Summary

Cursor confirmed malicious Claude Code extension 2.1.313 was available in its marketplace on October 29. Socket found no matching Open VSX or npm publication records; Cursor says it removed the extension and is contacting potentially affected users.

Key points

Cursor confirmed that malicious Claude Code extension version 2.1.313 was available through its marketplace on October 29, potentially affecting up to 5,000 users.
Socket found no version 2.1.313 publication or removal events in the reviewed Open VSX change feed; it recorded neighboring versions 2.1.312 and 2.1.314.
Socket also found no 2.1.313 entry in the npm package’s version list or publication-time records. These findings weigh against public distribution through Open VSX or npm but do not rule out every attempted or administrative action.
An earlier malware report described a macOS extension that added an SSH authorized key, attempted a reverse SSH tunnel, and installed persistence; it said the analyzed directory’s provenance was not established. Socket says it did not obtain or analyze the artifact.
A screenshot cited in the initial report showed version 2.1.313 as latest, but its displayed Linux and Windows download sizes matched public 2.1.314 builds. Socket said this did not prove the files were identical or that the screenshot was manipulated.
Cursor says it removed the extension, rebuilt its marketplace after rotating keys, worked with the hosting provider to take the attacker’s server offline, and is contacting affected users.

Article Details

Event Type: Confirmed malicious extension distribution through Cursor's marketplace
Impact: Cursor confirmed that malicious Claude Code version 2.1.313 was available through its marketplace on October 29, potentially affecting up to 5,000 users. Cursor says it removed the extension, rebuilt the marketplace after rotating keys, worked with the hosting provider to take the attacker's server offline, and is contacting affected users. A separate report described the sample as adding an SSH authorized key, attempting a reverse SSH tunnel, and installing persistence, but the sample's provenance was not established and Socket did not obtain or analyze it. Socket found no corresponding publication or removal records for 2.1.313 in Open VSX and no publication-time record in npm; public distribution through those registries remains unsubstantiated.

People

Jenn GileOpenSourceMalware co-founder whose initial LinkedIn post identified npm and Microsoft's VS Code Marketplace as affected distribution channels; the article later reports Cursor's confirmation of distribution through its own marketplace.

Vendors

AnthropicOpenSourceMalware initially reported that a malicious version of Anthropic’s Claude Code extension, 2.1.313, was published to the Open VSX registry. The analysis, written by Paul McCarty, described an unpacked macOS CursorCursor has confirmed that a malicious Claude Code extension labeled version 2.1.313 was available through its extension marketplace on October 29, potentially affecting up to 5,000 users. The disclosure identifies the

Products

Claude CodeCursor has confirmed that a malicious Claude Code extension labeled version 2.1.313 was available through its extension marketplace on October 29, potentially affecting up to 5,000 users. The disclosure identifies the