Trojanized Claude Code extension slips through Cursor's marketplace

Overview

Updated 1 hour ago

For roughly 11 hours on October 29, 2026, the Claude Code extension listed on Cursor's marketplace was not Anthropic's code. Version 2.1.313 carried a 66-line loader inserted ahead of the legitimate extension, and it tried to open a remote backdoor on the machines of developers who installed or auto-updated it.

The payload mostly failed: enabling SSH requires administrator rights the extension did not have on most machines. But it still wrote an attacker's key into the SSH configuration, planted persistence, and sent host details to a server. Cursor says at most 5,000 people installed it, and the method used to publish the modified package is still unexplained.

Why it matters

If you auto-update a coding tool, a marketplace's vetting is now part of your security perimeter, not the vendor's.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

5,000

Users exposed, at most

Cursor's upper bound on developers who installed or updated to 2.1.313.

About 11

Hours the malicious version was live

From roughly 2:27am to 1:35pm Pacific on October 29, 2026.

Lines of injected loader code

The malicious block sat before Anthropic's own JavaScript in the extension bundle.

2.1.313 → 2.1.314

Compromised version to clean version

Anthropic published the replacement build to Open VSX and Microsoft's marketplace.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Jenn Gile

Co-founder, OpenSourceMalware

Analyzed the malicious extension bundle

Paul McCarty

Security researcher

Analyzed what the payload collected and reported

Organizations Involved

Cursor

Software company and extension marketplace operator

Removed the malicious package, shut and rebuilt its marketplace

Maker of the Cursor code editor and operator of the extension marketplace where the trojanized build was distributed.

Anthropic

Artificial intelligence company

Published a clean 2.1.314 build to other marketplaces

Publisher of the Claude Code extension whose name and extension identifier the modified package used.

OpenSourceMalware

Security research group

Analyzed the injected loader

Research group that tracks malicious packages and examined the modified Claude Code bundle.

Timeline

5 events Latest: Today

Tap a bar to jump to that date

October 2026
Clean 2.1.314 published to other marketplaces
Today Release

Anthropic ships the replacement build to Open VSX and Microsoft.
Today
Modified 2.1.313 appears on Cursor's marketplace
Supply chain compromise

A trojanized build is published under Anthropic's extension identifier.
Yesterday • 02:27 PT
Cursor removes the package
Remediation

The malicious version is pulled after about 11 hours live.
Yesterday • 13:35 PT
Marketplace shut down, keys rotated, rebuilt
Remediation

Cursor audits access and confirms no other extensions were altered.
Yesterday
Attacker server taken offline
Remediation

Cursor works with the hosting provider to disable the beacon endpoint.
Yesterday

Scenarios

No affected machine ends up with a working backdoor

Likely Resolves by End of 2026

Discussed by: Cursor's security notice, which says the SSH step would fail without administrator rights

The malicious code wrote an attacker key and planted persistence, but enabling the SSH service required privileges the extension did not hold on most macOS and Windows machines. If Cursor's direct notices to the 5,000 users confirm that no tunnel came up, the incident stays a scare rather than a breach. The remaining risk is any host where the editor ran with elevated rights.

Attribution points to a stolen publishing credential

Uncertain Resolves by Q1 2027

Discussed by: The Hacker News and Cursor, both of which say the method of introduction is unclear

Nothing published so far explains how a modified build reached the marketplace under Anthropic's publisher identity. The two obvious routes are a compromised publishing token or an account with rights to push versions. A post-incident report naming the entry point would tell every other publisher what to lock down.

Marketplaces add mandatory signing for extension releases

Possible Resolves by Q2 2027

Discussed by: Supply-chain researchers and the researchers quoted in coverage of the incident

The incident exploited ordinary marketplace mechanics: a listed publisher's version number, an auto-update path, and no visible warning at install time. A policy response would require publishers to sign releases or produce verifiable builds, which adds friction for small extension authors. Whether Cursor or Microsoft adopts such a rule is the concrete test of whether anything changes.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

December 2020

SolarWinds Orion compromise (2020)

Attackers operating through SolarWinds' build environment inserted malicious code into updates for its Orion network monitoring software. About 18,000 customers downloaded the compromised update, and the intruders used it to reach a small number of government and corporate networks. FireEye disclosed its own breach in December 2020, which surfaced the campaign.

Then

Federal agencies, Microsoft and FireEye ran multi-month investigations, and CISA issued an emergency directive ordering agencies to disconnect Orion.

Now

The incident pushed software supply-chain security into federal policy, including a 2021 executive order on software bill of materials and vendor attestation.

Why this matters now

It established the template for this kind of attack: a legitimate vendor's update channel used as the delivery route, with the victim's own auto-update process doing the work.

January–April 2021

Codecov Bash Uploader backdoor (2021)

Someone modified Codecov's Bash Uploader script, which customers ran inside continuous-integration pipelines to send test coverage data. The altered script shipped environment variables from those build environments to an outside server for about two months before the company detected it.

Then

Codecov notified customers and rebuilt the script, and affected companies began rotating credentials that had passed through their CI pipelines.

Now

It became the standard example of developer tooling as a credential-harvesting path, and pushed CI vendors to checksum and sign their install scripts.

Why this matters now

The Claude Code payload collected environment variable names in the same spirit: not stealing secrets outright, but mapping where a follow-up attack would find them.

November 2018

event-stream npm package hijack (2018)

A maintainer of the widely used event-stream JavaScript library handed publishing rights to a contributor who had offered to help. That account then added a dependency containing malicious code aimed at the Copay bitcoin wallet, and the compromised version reached projects that depended on the package.

Then

The malicious version was pulled and the affected wallet application shipped a fix.

Now

Package registries added more maintainer controls and two-factor authentication, and the case became the reference point for trust failures in open-source publishing.

Why this matters now

It shows the same weak link this incident rests on: whoever holds publishing rights controls what thousands of machines install on the next update.