A trusted name on altered code

Cursor says its extension marketplace served malicious Claude Code-branded builds for Windows and macOS on October 29. The affected versions, 2.1.312 and 2.1.313, were not developed by Anthropic. Cursor removed them, rebuilt the marketplace and worked with the attacker’s hosting provider to take the malicious server offline.

Distribution and endpoint recovery diverge

Microsoft’s October 30 technical analysis describes code that ran before the extension’s ordinary initialization. It attempted to add an SSH access key, establish a reverse tunnel and create startup persistence. Those changes extend beyond the extension directory, making package removal an incomplete measure of endpoint recovery.

Attempted access is not confirmed access

Cursor says code errors and permission requirements prevented the SSH access step on most Windows and macOS hosts. Microsoft likewise distinguishes the loader’s capabilities from successful execution on each machine. Its analysis says reconnaissance collected selected environment-variable names, not their values; that finding alone does not prove secret theft. Neither limitation establishes that every affected workstation remained trustworthy.

The source of the package matters

Microsoft reports that the malicious packages were not distributed through its Visual Studio Marketplace or the Claude Code npm package. The distinction confines the disclosed distribution problem and prevents a branded extension from being mistaken for evidence that every official release was compromised.

An incident with a longer endpoint tail

Cursor’s notice calls for investigating installation and endpoint records, removing unauthorized keys and persistence, and addressing credentials accessible from affected machines. The operational issue for businesses is the gap between a clean marketplace today and a workstation that loaded altered code earlier. AI-tool adoption adds another software delivery route to that familiar supply-chain problem.

Sources & further reading

Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.

Suggest a correction →