Security · 1 November 2026
Cursor Marketplace Distributes Malicious Claude Code Extension to 5,000 Developers
A malicious version of Anthropic's Claude Code VS Code extension (version 2.1.313) was available in Cursor's extension marketplace for about 11 hours on Oct 29, exposing up to 5,000 developers to malware that installs persistent SSH backdoors.
Day 2 of this story
What's new: Adds exact version number 2.1.313 and precise 11‑hour distribution window, not in prior coverage.
31 OctAnthropic's Claude Code Extension Trojanized on Cursor Marketplace with Persistent SSH Backdoor
Why it matters
Developers faced malware via a malicious Claude Code extension (v2.1.313) in Cursor’s marketplace, so vet every VS Code extension’s provenance before release.
For product managers
For your product
What does this mean for your product?
Try it on your product More from this issueAll AI news from 1 Nov →
Get this every morning, written for your product.
Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.