Cursor says malicious Claude Code extension 2.1.313 was available in its marketplace October 29 between approximately 2:27 a.m. and 1:35 p.m. Pacific time. Anyone who installed or updated that build there should check. At most 5,000 were affected; Anthropic did not develop it.

The big change

  • Extensions can execute code before a conversation. Installation source and version determine exposure.
  • Failed SSH activation can limit access, while other changes still need investigation.
  • Updating alone cannot establish whether startup items remain or an account was accessed.

What the code attempted

OpenSourceMalware analyzed a loader ahead of normal extension code. Its page claims an Open VSX source but says the analyzed directory’s provenance is unestablished. It does not independently identify Cursor’s distributed package. Cursor separately reports similar backdoor and persistence attempts. Without administrator rights, SSH activation fails on most macOS and Windows hosts, it says; other actions can succeed.

The researchers describe activation without a conversation, an attempted SSH key and tunnel, and persistence via a macOS LaunchAgent or Windows task with Startup fallback. The initial beacon includes credential-related variable names, not values; static analysis found no additional executable download.

OpenSSH documentation describes an authorized keys file as a list of public keys usable to log in as a user. Remote forwarding directs connections arriving at a remote port over the SSH connection to a chosen destination. These are separate functions: access authorization and a route to a service. The service must accept the key and be reachable through the route for a login to work; a key in a file on its own does not show that a login happened.

Apple’s archived documentation describes user agents loaded by the system when a user logs in. Windows Task Scheduler can start a program when specified conditions occur.

The entry route, attacker identity and successful logins remain unknown.

Who should check

Cursor removed the build and rebuilt the marketplace; it says the attacker server is offline. Its notice provides svc-telemetry checks and remediation.

In its ransomware response guidance, Microsoft recommends isolating compromised systems while preserving them for investigation. That advice is general incident-response context, not a finding that ransomware was involved here. A team can review available endpoint and network records, preserve relevant evidence and decide whether a rebuild is appropriate; records can only show events they captured.

Socket's registry investigation found no corresponding Open VSX publication or removal records. Cursor found no evidence other versions or official distribution were affected.

BIG CHANGE reviewed public reports and did not download or execute the extension.