Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Summary

A tampered copy of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313 of anthropic.claude-code, was published to the Cursor VS Code Extension Marketplace on October 29 and stayed live for about 11 hours. The modified code ran during module loading on macOS and Windows, collected host information, and attempted to set up a reverse SSH tunnel and persistence, though Cursor says the SSH step likely failed without admin rights. Anthropic says it did not build or publish the modified versions and that its official channels were not affected.

Mitigation

Users should remove the malicious extension versions as soon as possible. Cursor released a detection script and indicators of compromise, and advises isolating affected hosts, removing the unauthorized SSH key, persistence mechanisms and tunnel processes, and assessing whether to rebuild the host. Anthropic updated its legitimate extension to version 2.1.314.

Topics

• Model and package supply chain

Related items

• InfoAnthropic reports $17 billion in Q3 revenue, purchase commitments of $895.4 billion in revised S-1Same vendor · CNBC Technology
• InfoCybersecurity M&A Roundup: 37 Deals Announced in October 2026Same vendor · SecurityWeek
• InfoThe U.S. Census Bureau and “Super Intelligence”Same vendor · Simon Willison's Weblog
• InfoStop counting tokens, start counting what shipsSame vendor · MIT Technology Review
• MediumCursor removes malicious Claude Code extension after SSH backdoor attemptSame vendor · CSO Online