Press play to start listening
Developers installing Claude Code through Cursor’s extension marketplace were offered tampered packages designed to collect information about their computers and give attackers remote access. Cursor removed the malicious downloads but warned that deleting the extension alone will not remove the files it left behind.
The company published its security notice on October 29, 2026, then updated it on October 30 to identify two affected versions, 2.1.312 and 2.1.313, for Windows and macOS. The packages were available between approximately 2.27 am and 1.35 pm Pacific Daylight Time on October 29, equivalent to 9.27 am to 8.35 pm GMT
Malicious Code Ran Before the Extension Started
OpenSourceMalware’s analysis of version 2.1.313 found a 66-line malicious loader inserted before the extension’s normal JavaScript code. The package retained the legitimate extension identity anthropic.claude-code, and included the genuine bundled binary.
The malicious loader executed before the extension’s normal code. OpenSourceMalware reported that it ran when the extension activated after startup or when its webview opened. The researchers identified the altered extension.js file as the difference from the normal package.
Microsoft’s separate investigation confirmed that the malicious packages were not distributed through its Visual Studio Marketplace or the Claude Code npm package. Anthropic also told Microsoft that its systems had not been compromised and that it had not developed the malicious package.
SSH Access Attempts Did Not Succeed on Every Computer
Once running, the loader gathered information about the host and user before attempting to add an attacker-controlled SSH key, enable SSH and create a reverse tunnel. Such a tunnel can provide a connection from an affected computer to an external server, allowing remote access when the necessary services and permissions are available.
Cursor said coding errors and administrator-permission requirements blocked the SSH access step on most Windows and macOS computers. However, the package could still leave tvflcf an unauthorised key, startup files, and transmitted device information. A failed tunnel therefore did not mean the installation required no cleanup.
Microsoft also identified startup mechanisms outside the extension’s installation directory. These included a macOS LaunchAgent, a Windows scheduled task named SysMon and a fallback script in the Windows Startup folder. Its analysis distinguishes what the code attempted from what investigators could confirm had succeeded on an individual computer.
Removing the Extension Is Only Part of the Cleanup
Cursor temporarily closed the marketplace, rotated keys and rebuilt it before restoring service. It also worked with the hosting provider to take the attacker’s server offline.
Affected users should follow the detection and remediation instructions in the official notice, remove the unauthorised SSH key and persistence files, and rotate accessible credentials from a trusted computer. Cursor provides separate cleanup scripts for Windows and macOS and advises assessing whether affected computers need to be rebuilt.
Editor’s note: Cursor’s initial notice said at most 5,000 users were affected. That figure has since been removed, and the updated notice identifies version 2.1.312 alongside 2.1.313. The original notice is available through the Internet Archive.
