What happened
Cursor disclosed that tampered copies of the Claude Code extension were distributed through its own VS Code extension marketplace on October 29, 2026. The affected versions were 2.1.312 and 2.1.313, available for roughly eleven hours. Cursor estimated that at most 5,000 users were affected. The modified package attempted to gather machine and user details, add an attacker-controlled SSH authorization key, and establish persistent remote access. Cursor removed the packages, temporarily shut down the marketplace, rotated keys, and restored service after an audit. In an independent technical analysis published October 30, Microsoft Security Research examined the injected code and described its reconnaissance, SSH setup and persistence behavior. Microsoft also confirmed that the malicious packages were not distributed through its Visual Studio Marketplace or the official Claude Code npm package. Anthropic said its own systems had not been compromised.
Why it matters
Developer extensions often receive broad access to source code, local files and execution tools. A package delivered through a familiar marketplace can therefore become an attractive supply-chain entry point even when the original software author is uninvolved. This case illustrates a second problem: the malicious loader tried to leave changes outside the extension itself. Cursor says flaws in the attacker's code prevented the reverse SSH tunnel from working on most macOS and Windows systems without administrator privileges. That limitation reduced the apparent reach of remote access, but it did not prove every exposed machine was clean. The attacker-controlled key, startup mechanisms and transmitted host details still required investigation. A count of potentially affected users is not the same as a confirmed count of fully compromised computers.
What to watch next
Organizations should identify whether affected versions were installed from Cursor during the disclosed window, preserve evidence and follow the vendor's removal guidance. Cursor and Microsoft advise checking SSH authorization entries and persistence mechanisms, isolating systems showing execution, and rotating credentials where exposure is plausible. Merely updating or uninstalling the extension may leave separate scripts behind. Future disclosures should clarify how the altered package entered the marketplace, how many installations executed the payload and whether attackers achieved interactive access. Marketplace signing, publisher-account controls and update provenance deserve scrutiny, but no single safeguard should be assumed to eliminate extension supply-chain risk.