Cursor removes malicious Claude Code extension 2.1.313 with SSH persistence
Cursor confirms a modified Anthropic.claude-code 2.1.313 package in its marketplace, potentially affecting at most 5,000 users. It collects host details and installs SSH persistence. Admin-rights restrictions often prevented remote login, but affected machines still need cleanup. Cursor says the attacker server is offline.
- Disclosed
- Oct 29, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- macOS and Windows users who installed the modified 2.1.313 package from Cursor’s extension marketplace
- Cursor · Claude Code · supply chain
- In the wild
- Yes
- Cursor confirms malicious distribution, not successful remote access on every host.
What happened
The modified package was not developed by Anthropic. Cursor’s notice identifies macOS arm64 and Windows x64 packages. SSH-service activation generally requires administrator rights, so remote login often failed; SSH keys, persistence and host-data reporting still require investigation. Scope is the identified distribution, not every Claude Code installation. L4 reflects a confirmed developer-tool supply-chain compromise.
Crime-scene timeline
Oct 29, 2026
Malicious package distributed and removed
Cursor gives an exposure window of about 2:27am–1:35pm PT and publishes its security notice dated October 29.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Cursor security notice and complete IoC tablesPrimaryConfirms the Cursor-marketplace package, affected-user upper bound and response; does not establish compromise of Anthropic’s official distribution.