Claude Code Extension Malware in Cursor: Who Is Affected and What to Check

Cursor disclosed a malicious Claude Code extension package on October 29. Version Anthropic.claude-code 2.1.313 in its extension marketplace attempted to install an SSH backdoor. Cursor says at most 5,000 users were affected, making the immediate question which package developers installed, rather than whether every Claude Code user is exposed.

Which Claude Code version is affected?

Cursor's security notice identifies an approximate distribution window of 2:27 a.m. to 1:35 p.m. Pacific Time on October 29. It says the malicious version was not developed by Anthropic and reports no evidence that other versions or the official distribution were affected.

Cursor removed the package, audited the marketplace, rotated keys and rebuilt it. The attacker server was taken offline. Those are containment measures, not proof that an affected laptop is clean.

The distinction matters when reading incident headlines. A recognizable extension name, the company that develops the legitimate product and the marketplace distributing a particular package are three different things. The confirmed scope is a specific package in Cursor's marketplace, not a demonstrated compromise of every Claude Code installation.

What the malicious extension did

Phorion's technical analysis, published October 30, describes injected code running as the extension module loads, before its normal activation callback. A developer did not need to ask the assistant to do anything for that code to execute.

The payload attempted to add an attacker-controlled SSH key, arrange a reverse tunnel and establish persistence. Phorion found a macOS logic error that could prevent SSH from being enabled, while still leaving keys and persistence behind. Its analysis also identifies a Windows implementation problem and notes that the setup does not include a privilege-escalation exploit.

That makes the result dependent on the machine's existing state and permissions. A failed connection attempt does not establish that nothing happened. It also means the presence of malicious code should not be casually equated with proof that an attacker successfully logged into every affected machine.

What affected developers should check

Cursor advises checking installation records and its published indicators, isolating hosts with evidence of execution, removing unauthorized keys and persistence, and assessing whether rebuilding is necessary. It also recommends rotating accessible credentials and sessions from a trusted system. Uninstalling the extension alone may leave standalone scripts behind.

Use the maintained vendor notice for platform-specific checks and remediation rather than copying a partial command from a social post. For a company laptop, involve the security team before deleting artifacts that may be useful for understanding what ran.

There are two separate questions to answer: whether the affected package was installed, and what that package actually managed to do. Keeping those questions separate helps avoid both unnecessary panic and premature reassurance.

Why extension trust belongs in AI tooling decisions

Microsoft's extension security documentation explains the underlying permission model: a VS Code extension host has the editor's permissions, including access to files, network requests and external processes. Its documentation also distinguishes publisher verification from package integrity checks and describes organization-level extension controls.

That is useful context, not evidence that Microsoft's marketplace was affected by this incident. The practical lesson is that evaluating an AI coding tool cannot stop at the model or the agent's approval screen. Teams also need to know which distribution channel supplied the executable code around it.

An inventory that records only “Claude Code installed” is less useful during an incident than one recording package version, source and installation time. Those details turn a broad warning into a narrower investigation, without relying on the popularity of the product name as a security guarantee.

I’m Paras. I work at the intersection of AI, engineering and distribution.

I help technical teams explain complex AI products and important product updates clearly, so developers and founders can understand and share them.

Book a 30-minute call.