Trojanized Claude Code Extension Hit Cursor Marketplace: What Developer Teams Should Check Now

The incident is a software supply chain attack aimed at developer workstations. A malicious package was published under Anthropic's legitimate extension identifier and served only through the Cursor marketplace. According to Field Effect, the malicious build was live from about 2:27 a.m. to 1:35 p.m. Pacific time on October 29, 2026.

Sophos X-Ops published its analysis and BleepingComputer reported the same incident. Anthropic has said no Claude Code vulnerability was exploited, so this is a distribution-channel compromise rather than a flaw in the product itself. For teams that treat editor extensions as trusted software, it is a reminder that they run with the full privileges of the developer.

What happened and when

On October 29, 2026, version 2.1.313 of the Claude Code extension in the Cursor marketplace carried a malicious loader. Cursor removed the package, took its marketplace offline for a time, rotated keys and audited marketplace access, and reported no evidence that other extensions were tampered with.

• Exposure window: roughly 2:27 a.m. to 1:35 p.m. PT on October 29, 2026 (09:27 to 20:35 UTC), covering macOS and Windows packages per Sophos.
• Scale: Cursor estimates up to 5,000 users may have installed the affected package.
• Fix: Anthropic released a clean version 2.1.314 on October 30, 2026. Field Effect's November 2 update says version 2.1.312 may also have been affected.
• Scope: as of the November 2 update, Cursor, Microsoft and Anthropic indicate the issue was limited to the Cursor marketplace, with no sign of impact on the Visual Studio Marketplace or Anthropic's npm package.

What the malware does

The injected code is a short loader at the start of the extension's main JavaScript file. It runs as soon as the extension loads, with no action from the developer, and aims to give the attacker persistent remote access to the machine.

• It collects host details such as hostnames, usernames, operating system data, working directories, Git configuration and the names of credential-related environment variables.
• It adds an attacker-controlled SSH key to authorized_keys, tries to enable the SSH service and attempts a reverse SSH tunnel to an external server.
• It installs persistence through LaunchAgents on macOS, scheduled tasks on Windows and cron entries on Linux.
• Researchers observed no further payload downloads. Cursor says coding errors stop the SSH step on most Windows and macOS machines unless Cursor was running with administrator privileges.

The partial failure lowers the odds of a full compromise, but it does not make the incident harmless. Persistence scripts and any planted key can remain on a host even when the backdoor never connected.

Why it matters for B2B software teams

Developer endpoints hold source code, cloud credentials, API tokens and signing keys. An attacker who reaches one can pivot into repositories, CI/CD pipelines and production accounts. That is why this event matters beyond the 5,000 affected installs.

AI coding assistants and their extensions have become a standard part of engineering toolchains, which makes marketplaces a high-value target. Supply chain guidance such as NIST SP 800-161 Rev. 1 asks organizations to manage third-party component risk, and extensions installed from a public marketplace fall squarely in that scope. Teams that run Cursor or similar editors should treat extension updates like any other third-party software change.

For buyers, the lesson is procurement-level as well as technical. Ask vendors how their extensions are signed, how marketplace publishing keys are protected and how quickly they can revoke a bad release. Compare options in our EDR software category and unified endpoint management category when you need tooling that can find and contain compromised developer machines.

What to do now: a response checklist

Start by finding out whether anyone in your organization installed or auto-updated the extension on October 29. Uninstalling or upgrading is not enough, so treat any matching machine as potentially compromised until cleaned.

• Inventory hosts running Cursor and check whether version 2.1.313 (and, per Field Effect, 2.1.312) was installed during the window.
• Isolate matching machines and preserve evidence before cleanup.
• Check for the published indicators, including an unexpected SSH key in authorized_keys, new scheduled tasks, LaunchAgents or cron entries, and outbound connections to the infrastructure listed in the Sophos and Field Effect write-ups.
• Remove the planted key, persistence entries and tunnel processes, then upgrade to 2.1.314 or later.
• Rotate cloud credentials, repository tokens and API keys that were reachable from affected machines.
• Pin extension versions or restrict marketplace sources where your policy allows, and review auto-update settings.

Related SaaSPodium categories

Developer endpoint incidents are easier to contain with the right tooling in place, so use these two categories to shortlist products for the controls above: Endpoint Detection & Response (EDR) Software for detection and containment, and Unified Endpoint Management (UEM) Software for inventory and policy enforcement across developer laptops.

Sources for this article include Field Effect (October 30, 2026, updated November 2), Sophos X-Ops and BleepingComputer. Details may change as vendors update their advisories, so check the original reports before acting.

Frequently Asked Questions

How do I know if my team installed the malicious Claude Code extension?
Check each Cursor installation for Claude Code version 2.1.313 (and, per Field Effect's update, 2.1.312) and for installs or updates on October 29, 2026 between about 2:27 a.m. and 1:35 p.m. Pacific time. Also look for an unexpected SSH key and new persistence entries.

Is removing the extension enough to be safe?
No. Sophos and Field Effect both state that uninstalling or upgrading does not remove the planted SSH key or persistence entries. Isolate the machine, remove those artifacts, rotate reachable credentials and then install version 2.1.314 or later.

Does this mean Claude Code itself is vulnerable?
No. Anthropic has said the incident did not exploit a Claude Code vulnerability, and reports indicate only the Cursor marketplace distributed the trojanized build. It is a marketplace supply chain compromise, so the fix is extension hygiene and credential rotation rather than a product patch.