Tampered Claude Code builds reached Cursor’s extension marketplace
Malicious copies of Claude Code extension versions 2.1.312 and 2.1.313 were distributed through Cursor’s marketplace for Windows and macOS. The incident concerns tampered packages rather than an Anthropic release. Cursor removed them, audited its marketplace and disabled the attacker’s server with its host. An installed version number alone does not establish whether a developer’s machine was compromised.
Artificial Intelligence··Night
The malicious copies came through Cursor’s marketplace
Tampered copies of Claude Code, Anthropic’s coding-assistant extension, were distributed through Cursor’s VS Code Extension Marketplace on October 29. Cursor’s notice identifies versions 2.1.312 and 2.1.313 for Windows and macOS. The malicious packages carried code intended to establish continuing access to developer computers. Security company StepSecurity describes the same incident and clarifies that Anthropic did not build or publish those packages. The affected distribution channel was Cursor’s marketplace; the reports do not establish a compromise of Anthropic’s systems or its official extension distribution channels.[1], [2]
Package origin and download period determine exposure
Having either version installed is not sufficient to establish that a machine was compromised. Cursor limits the relevant exposure to installations or updates obtained from its marketplace during the identified period on October 29. StepSecurity’s corrected account distinguishes the clean Open-VSX copy of 2.1.312 from the tampered Cursor artifact. Anthropic said 2.1.313 was never published through its official hosts, Open-VSX or Microsoft’s Visual Studio Marketplace. It skipped to 2.1.314 to avoid confusion. The version label therefore has to be considered with the package’s origin rather than treated as a universal finding about every copy.[1], [2]
The code attempted to install components that could remain after the extension was uninstalled. Cursor says some remote-access steps required administrator rights and would fail on most ordinary Windows and macOS hosts. It nevertheless describes unauthorized access components and the transmission of host information. StepSecurity also reports persistence risk. The statements distinguish an attempt to create continuing access from proof that the attacker successfully entered every exposed computer, and neither establishes that all affected users had data stolen.[1], [2]
Cursor removed the builds and audited the marketplace
Cursor says it removed the malicious builds, blocked further distribution and temporarily took the marketplace offline. It then audited access, found no other tampered extensions, rotated keys and rebuilt the service before reopening it. The company also worked with the hosting provider to take the attacker’s server offline. Its notice calls for affected systems to be checked for signs of execution and for compromised machines to be isolated and remediated. Credentials accessible from affected hosts are included in the response guidance. These actions address the distributed packages and computers that received them.[2]
