Anthropic Ships Clean Claude Code Extension After Fake Version Hit Cursor Users

A tampered copy of the Claude Code extension sat in Cursor's marketplace for about 11 hours and planted a hidden SSH key on some computers.

A tampered version of the Claude Code extension for code editors was served through the Cursor marketplace on October 29, according to The Hacker News. The bad update, version 2.1.313, used the real extension ID. Cursor said the version "was not developed by Anthropic," and Anthropic has since published a clean version, 2.1.314.

The malicious version was installed between about 2:27 a.m. and 1:35 p.m. Pacific on October 29, and Cursor says at most 5,000 users were affected. The Hacker News reports that it adds an attacker's SSH key to the computer's authorized keys file, tries to set up persistence, and sends basic details about the machine, such as the username and the names (not values) of environment variables that look like keys or tokens. No other payloads have been seen so far, but the setup could let an attacker run commands. The report says there is no evidence it reached the Open VSX or Microsoft VS Code marketplaces, and it is still unclear how the attackers got the update in.

If you or a developer you hire uses Cursor with Claude Code, check the installed version. Where 2.1.313 was installed, The Hacker News advises isolating the machine, removing the unknown SSH key and any scheduled tasks or startup items it added, and rotating passwords and access keys. Cursor says it will contact affected users directly.