Cursor Removes Malicious Claude Code Extension, Warns Up to 5,000 Users

Cursor removed a malicious version of the Claude Code extension from its marketplace on October 29, according to a company security notice. The package impersonated an extension from Anthropic and may have affected up to 5,000 users.

Version 2.1.313 was available from about 2:27 a.m. to 1:35 p.m. PT. It collected host and user details, added an attacker controlled SSH key, and tried to create a persistent reverse SSH tunnel. The attempt to enable local SSH access would fail on most Windows and macOS systems because it required administrator privileges.

Cursor removed the package, shut down and rebuilt the marketplace, rotated its keys, and worked with the hosting provider to disable the attacker server. It found no evidence that other extension versions or the official distribution were affected.

Users who installed or updated the extension during the affected period should isolate compromised systems, remove the SSH key and persistence scripts, and rotate credentials from a trusted device. Uninstalling the extension alone may not remove the scripts left on the system.