Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace

Summary

Cursor confirmed that a malicious Claude Code extension labeled version 2.1.313 was available through its extension marketplace on October 29, potentially affecting up to 5,000 users. Socket's investigation found no corresponding publication or removal records on Open VSX, the channel originally attributed in a malware report from OpenSourceMalware, which has since been substantially revised.

Related items

• MediumTrojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer MachinesSame vendor · StepSecurity Blog
• MediumOfficial Claude Code VS Code Extension Compromised to Install Persistent SSH BackdoorSame vendor · The Hacker News
• MediumBeyond deterministic worms: Preparing the SOC for reasoning adversariesSame vendor · CSO Online
• InfoAPI credits benefit for eligible ChatGPT subscriptionsSame vendor · Simon Willison's Weblog
• LowAnthropic-Themed Phishing Emails Bypass Top Security ToolsSame vendor · Dark Reading