---
id: 2026-10-claude-code-extension-2-1-313-cursor-marketplace-remove-and-rotate
title: "Harmful Claude Code extensions 2.1.312 and 2.1.313 from Cursor: check your installation and remove affected copies"
kind: malicious-artifact
date_disclosed: 2026-10-29
last_updated: 2026-11-03
severity: critical
status: contained
ecosystems: [vscode-extension, cursor-marketplace, npm, open-vsx]
tools_affected: ["Cursor users on macOS or Windows who installed or auto-updated anthropic.claude-code 2.1.312 or 2.1.313 from the Cursor Marketplace between about 02:27 and 13:35 PT on 2026-10-29", "machines holding SSH keys, cloud and provider keys, Git and registry tokens and environment-variable secrets that ran Cursor with that version"]
tags: [malicious-artifact, vscode-extension, cursor-marketplace, claude-code, ssh-backdoor, persistence, credential-theft, supply-chain, marketplace-compromise, auto-update, cursor-notice, anthropic-staff-statement]
---

## TL;DR
Remove the harmful copies of the Claude Code extension (`anthropic.claude-code` 2.1.312 or 2.1.313) supplied through Cursor's marketplace, and use 2.1.314 or later. If checks show the harmful code ran or added a way for someone else to log in, follow the cleanup steps below and replace passwords, keys and login tokens it could have accessed; a file or program name matching a search is not enough to show this happened.

## Packages and versions

| Ecosystem | Name | Bad versions | Clean version or action | Registry state (date checked) | Record |
|---|---|---|---|---|---|
| Cursor Marketplace (VS Code extension) | `anthropic.claude-code` (listed under the Anthropic publisher name; Cursor says Anthropic did not develop it) | 2.1.312 and 2.1.313 (modified macOS/Windows copies) | remove; after any needed cleanup, install 2.1.314 or later | removed by Cursor on 2026-10-29 at about 13:35 PT; marketplace shut down, keys rotated, rebuilt and back online (Cursor notice, read 2026-10-30) | none read (no OSV or GHSA record for the extension) |
| npm | `@anthropic-ai/claude-code` | none | 2.1.314 (2026-10-30 00:12 UTC) is `latest` | `time` goes 2.1.312 (10-27) to 2.1.314 with no 2.1.313 entry and no unpublish marker (2026-10-30) | none |
| Open VSX | `anthropic.claude-code` | none | 2.1.314 (2026-10-30 01:07 UTC) | the API returns "Extension not found" for 2.1.313 (2026-10-30) | none |
| Microsoft VS Marketplace | `anthropic.claude-code` | none | 2.1.314 (2026-10-30 01:17 to 01:20 UTC, per platform) | 2,385 version rows, none 2.1.313 (2026-10-30) | none |

[Cursor's notice](https://cursor.com/blog/claude-code-extension-security-notice), updated 2026-10-30 at 11:30 PT, now lists modified **2.1.312 and 2.1.313** packages for macOS and Windows, adding 2.1.312 to its earlier warning. These copies were available from about 02:27–13:35 PT on 2026-10-29. Cursor has not found evidence that other versions or copies from the official sources were affected. The table records each download source separately: an official copy is not harmful just because it shares a version number with a modified copy from Cursor. The earlier notice reported at most 5,000 users; the updated notice no longer gives that count. OpenSourceMalware and Phorion published independent analyses. Phorion's claim that 2.1.313 was also pulled from npm and the Microsoft marketplace was not supported by the registry timelines read earlier on 2026-10-30.

## Am I affected?

**1. Check what you installed and where it came from.** Check whether Cursor downloaded an affected 2.1.312 or 2.1.313 copy during the times listed above. These commands list extension folders on your computer; installation and update records can help you or your agent check what was there before.

```bash
# macOS/Linux: list installed folders, including clean versions such as 2.1.314
ls -d ~/.cursor/extensions/anthropic.claude-code-* 2>/dev/null
```

```powershell
# Windows: list installed folders
Get-ChildItem "$env:USERPROFILE\.cursor\extensions" -Directory -Filter 'anthropic.claude-code-*' -ErrorAction SilentlyContinue
```

If you only ever had clean 2.1.314, seeing its folder in this list does **not** mean this incident affected you. If you updated to 2.1.314 after using an affected version, the update alone does not tell you whether cleanup is needed.

A folder name does not prove where a copy came from or whether it ran. If you saved the downloaded extension file (a `.vsix` file), compare its SHA-256 checksum—a value used to identify the exact file—with Cursor's published values for your version and operating system. A match identifies a harmful copy, but still does not prove it ran. Do not install or open a suspect copy just to check it.

**2. Look for warning signs, then check what they mean.** The commands below only read information. They look for files, saved remote-login keys, startup jobs and running programs mentioned in the reports. Other legitimate software can have the same names, so a search result alone does not mean your computer was affected.

```bash
# macOS/Linux: look for a key label and files mentioned in the reports
grep -n 'svc-telemetry' ~/.ssh/authorized_keys 2>/dev/null
ls -la ~/.config/.smt ~/.config/.smtk "${TMPDIR:-/tmp}"/.stk_* 2>/dev/null
# macOS: look for a startup job mentioned in the reports
ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist 2>/dev/null
# Linux: list jobs set to run after a restart; these may be legitimate
crontab -l 2>/dev/null | grep -n '@reboot'
# macOS/Linux: find SSH programs; these may be legitimate remote connections
pgrep -fl 'autossh|ssh .* -R' 2>/dev/null
```

```powershell
Select-String -Path "$env:USERPROFILE\.ssh\authorized_keys","C:\ProgramData\ssh\administrators_authorized_keys" -Pattern 'svc-telemetry' -ErrorAction SilentlyContinue
Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue
Get-ChildItem "$env:USERPROFILE\.config\smt.cmd","$env:USERPROFILE\.config\smtk","$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\sysmon.cmd" -ErrorAction SilentlyContinue
```

Cursor's current warning covers macOS and Windows copies. Researchers also listed Linux paths; finding those paths does not establish that Cursor distributed a harmful Linux copy.

**3. Check whether the harmful code ran or added remote access.** [Cursor's notice](https://cursor.com/blog/claude-code-extension-security-notice) lists the exact files, keys and connections to compare. You or someone helping you can check:

- **Remote-login keys:** compare the actual SSH key, or its identifying fingerprint, with Cursor's published key. The `svc-telemetry` label alone is not enough because labels can be changed. A matching, unauthorized key added to `authorized_keys`—the list of keys allowed to log in—supports a finding that unwanted remote access was set up. The same key merely stored inside a downloaded extension does not.
- **Startup jobs and files:** inspect what they contain and when they appeared without running them. Compare that information with the extension's installation history. A matching filename or an unrelated `@reboot` job is not enough.
- **Records of running programs and connections:** look for records showing the harmful code ran, or that it made connections matching Cursor's report. An ordinary SSH connection, or a visit to a service that tells you your public IP address, does not establish that.

Finding nothing does **not** prove the harmful code never ran. Changes meant to survive a restart may have failed or been removed, and older records may be missing. If you know an affected copy was installed but cannot tell whether it ran, remove it and ask for help; you can choose to replace exposed keys as a precaution without claiming that a break-in was confirmed.

## If you are affected

**You found an affected copy, but do not know whether it ran:** save its version, download source and any file checksum, then remove it. Follow the checks above or contact Cursor at `security@cursor.com`. A broad search result alone is not a reason to disconnect your computer, delete unrelated startup jobs or reinstall its operating system.

**Checks show the harmful code ran or added unwanted remote access:** follow these steps even if you have already updated the extension:

1. Disconnect the computer from the network. Save relevant installation, running-program and connection records before cleanup, if possible.
2. Follow Cursor's cleanup instructions for your operating system. Remove the unwanted login keys, startup jobs and connections it identifies, then uninstall the affected extension. Removing the extension alone may leave those changes behind; get help deciding whether the operating system should be reinstalled.
3. From another computer you trust, replace passwords, API keys and login tokens accessible from the affected computer, and sign out existing sessions. This is what security guides call **rotating credentials**. Include SSH keys, cloud and AI-provider API keys, GitHub and npm tokens, and secrets stored in environment variables (settings available to programs). See [cloud credential steps](../playbooks/rotating-cloud-credentials.md), [GitHub token steps](../playbooks/if-your-github-pat-leaked.md) and [npm token steps](../playbooks/if-your-npm-token-leaked.md).
4. After cleanup, install 2.1.314 or later from a source you have verified.

## Prevention

- Record the extension name, version and marketplace so you can check future warnings. Automatic updates can install a harmful copy without you choosing it that day. Consider reviewing extension updates before installing them on a computer with important account access; do not leave updates off indefinitely.
- Use the publisher's official download sources where your editor allows it. For this extension, the Open VSX and Microsoft marketplace copies are not known to be affected by this incident.
- Give coding agents access only to the account keys they need. See [how to store and limit account keys](../prevention/credential-hygiene.md) and [where risky downloads can enter a project](../prevention/supply-chain-attack-surface.md).

## Sources
- [Cursor — Claude Code extension security notice](https://cursor.com/blog/claude-code-extension-security-notice) — re-read 2026-10-30 after the 11:30 PT update: affected macOS/Windows marketplace copies now include 2.1.312 and 2.1.313; package hashes, SSH-key indicators, evidence-based isolation and remediation guidance. This supersedes the earlier 2.1.313-only scope and user count.
- [The Hacker News — Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html) — fetched 2026-10-30: 2026-10-30, Ravie Lakshmanan, 2.1.314 published to Open VSX and the Microsoft marketplace, Open VSX and Microsoft installs not known to be affected, the `svc-telemetry` label, the OpenSourceMalware statement.
- [OpenSourceMalware — Trojanized Claude Code Extension Plants Persistent SSH Backdoor](https://opensourcemalware.com/blog/trojanized-claude-code-extension-plants-persistent-ssh-backdoor) — fetched 2026-10-30: 2026-10-30 09:42 UTC, the npm package, Open VSX and Microsoft extension stated as not malicious, "The provenance of the analyzed directory is not established", the later update naming the Cursor Marketplace as the origin, the file and process checks, "Rebuilding the host is safer", credit Dean Hardcastle.
- [Phorion — Compromised Claude Code for VS Code Extension](https://phorion.io/blog/offical-claude-code-vsx-compromise/) — fetched 2026-10-30: 2026-10-30, Calum Hall, the macOS, Linux and Windows persistence paths quoted above, the remediation list, the statement that Cursor pulled 2.1.313 from the npm and VS Code registries (not borne out by the registry timelines read this run).
- [Unite.AI — Cursor Discloses SSH Backdoor Attempt in Malicious Claude Code Extension](https://www.unite.ai/cursor-discloses-ssh-backdoor-attempt-in-malicious-claude-code-extension/) — fetched 2026-10-30: 2026-10-30, Cursor's statements quoted verbatim; no statement attributed to Anthropic.
- npm registry `@anthropic-ai/claude-code` `time` and `dist-tags`, queried 2026-10-30: 2.1.312 at 2026-10-27 18:36 UTC, 2.1.314 at 2026-10-30 00:12 UTC, no 2.1.313, `latest` 2.1.314.
- Open VSX API `open-vsx.org/api/anthropic/claude-code` and `/2.1.313`, queried 2026-10-30: newest 2.1.314 at 01:07 UTC; "Extension not found: anthropic.claude-code 2.1.313".
- Microsoft VS Marketplace `extensionquery` API, queried 2026-10-30: 2,385 version rows for `anthropic.claude-code`, newest 2.1.314 at 01:17 to 01:20 UTC, none 2.1.313.
- [Visual Studio Code 1.123 release notes](https://code.visualstudio.com/updates/v1_123) — fetched 2026-10-30: 2026-06-03, background on extension updates: the two-hour delay and the trusted-publisher exemption.
- [Anthropic — News](https://www.anthropic.com/news) and [anthropics/claude-code — security advisories](https://github.com/anthropics/claude-code/security/advisories) — fetched 2026-10-30: no post or advisory about 2.1.313 or the Cursor Marketplace.
- Hacker News items 50301983 (title "Claude Code VS Code extension with backdoor released on Cursor marketplace", linking a Medium post whose URL says Anthropic was hacked; 393 points), 50300683 (Phorion, 163 points), 50301004 (Cursor notice) and 50300112 (OpenSourceMalware), read through the Algolia items API 2026-10-30 for titles, times and links; the Medium post was not opened.
- [The Register — Anthropic: That Claude Code extension compromise… couldn't be us](https://www.theregister.com/cyber-crime/2026/10/30/anthropic-that-claude-code-extension-compromise-couldnt-be-us/5306682) — fetched 2026-10-31: 2026-10-30 16:27 UTC, Connor Jones; Felix Rieseberg's three statements quoted in the 2026-10-31 update, Cursor's "removed the malicious version ... immediately upon detection" and "full shutdown of the VSCode Marketplace" quotes, the "up to 5,000" figure attributed to industry figures, and that neither company has said how the publisher's marketplace access was obtained.
- [StepSecurity — Trojanized Claude Code Extension Delivered Persistent SSH Backdoor to Developer Machines](https://www.stepsecurity.io/blog/claude-code-extension-trojanized) — fetched 2026-10-31: 2026-10-30, Rohan Prabhu; David Dworken's statement that 2.1.313 was never published to Open VSX, the Microsoft Marketplace or any official host and that the next release was 2.1.314; the Open VSX 2.1.312 build downloaded and verified clean; Cursor's audit finding no other extensions tampered with, the 2.1.312 replacement with clean bytes, and the attacker server taken offline with its hosting provider; the credential categories to rotate.
- [The Hacker News — Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor](https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html) — re-read 2026-10-31: "The exact method attackers used to introduce the unauthorized update remains unclear"; Cursor's "at most 5,000 users" statement; OpenSourceMalware's Jenn Gile on auto-update exposure.

## Update 2026-10-31 — Anthropic's statements arrive through staff, not a post: no compromise of Anthropic systems, 2.1.313 never on an official host; Cursor says no other extension was tampered with and the publication path is still unexplained

Anthropic has published no post or advisory, but two of its staff have spoken on the record. Felix Rieseberg, member of Anthropic's technical staff, to The Register (2026-10-30): "We're working with Cursor on this incident, but it wasn't a compromise of Anthropic's systems or employee laptops"; "A malicious actor used access to Cursor's marketplace to publish a tampered copy of the Claude Code extension" that Anthropic did not build or publish; "The versions on our official channels are not affected, and this only impacts Cursor users." David Dworken, per StepSecurity (2026-10-30): 2.1.313 was never published to Open VSX, the Microsoft Marketplace or any official host, and the next release was numbered 2.1.314. Both statements match the registry and marketplace timelines this file recorded on 2026-10-30.

Cursor's position, per StepSecurity and The Register: it audited marketplace access and found no other extensions tampered with; it replaced the marketplace's 2.1.312 with clean bytes, which StepSecurity verified, so a current install from Cursor is not re-infecting; the attacker's server was taken offline with its hosting provider's cooperation; and it has not said how the tampered copies were published under the Anthropic publisher identity. The Hacker News (2026-10-30) records the same gap: "The exact method attackers used to introduce the unauthorized update remains unclear." The "at most 5,000 users" figure is Cursor's from the first notice; the updated notice no longer gives a count, and The Register attributes "up to 5,000" to industry figures. StepSecurity downloaded Open VSX's 2.1.312 and verified it clean, which confirms the table's point that a version number shared with a modified Cursor copy does not make an official copy harmful.

Nothing in the update changes the checks or the remediation above. `status` stays `contained` because the marketplace copies are gone and the official channels were never affected; the open question is the publication path, which only Cursor can answer. A community indicator-checking repository was linked on Hacker News on 2026-10-30; its README could not be read at the default branch this run and it is not cited.

## Update 2026-11-02 — SecurityWeek puts the download count at about 5,000 systems, cites Microsoft's analysis, and repeats that no official channel carried the versions; Cursor's notice is unchanged since 10-30 and the publication path is still unexplained

SecurityWeek (2026-11-02) reports the tampered `anthropic.claude-code` 2.1.312 and 2.1.313 were available from Cursor's marketplace for roughly eleven hours on 2026-10-29 and were not published to the Visual Studio Marketplace, Open VSX or npm, which matches the registry and marketplace timelines this file recorded on 2026-10-30. It attributes the figure of roughly 5,000 developer systems that may have downloaded the versions to Kevin Beaumont and cites an analysis by Microsoft, and it carries the same three statements from Anthropic's Felix Rieseberg recorded in the 2026-10-31 update. Cursor's statements to SecurityWeek match its notice: the modified extension removed, the marketplace suspended, no other malicious extensions found, keys rotated, the marketplace rebuilt and reopened, the attacker's server taken offline with the hosting provider, and "We have no evidence that other versions of the extension or the official distribution are affected." SecurityWeek repeats Cursor's warning that uninstalling the extension may not be sufficient and that affected hosts should be assessed for rebuilding.

SafeDep's October 2026 incident review (2026-11-01) lists the incident as "Cursor marketplace, October 29" with the notice as its primary and adds nothing to it. Cursor's notice, re-read 2026-11-02, carries no update stamp after 2026-10-30 11:30 PT, states no user count, and still does not say how the modified versions were published under the Anthropic publisher identity. Anthropic has still published no post or advisory of its own. Nothing changes in the checks or remediation above; `status` stays `contained`.

Sources for this update: [SecurityWeek — Malicious Claude Code Extension Served in Cursor Supply Chain Attack](https://www.securityweek.com/malicious-claude-code-extension-served-in-cursor-supply-chain-attack/) (fetched 2026-11-02: 2026-11-02 07:29 ET, the eleven-hour window, the channels not affected, the roughly 5,000 figure attributed to Kevin Beaumont, the Microsoft analysis, the Anthropic and Cursor statements, the remediation list); [SafeDep — October 2026 Security Incident Review](https://safedep.io/blog/october-2026-security-incident-review.md) (fetched 2026-11-02: 2026-11-01, fourteen incidents, the Cursor marketplace entry linking Cursor's notice); [Cursor — Claude Code extension security notice](https://cursor.com/blog/claude-code-extension-security-notice) (re-read 2026-11-02: last update stamp 2026-10-30 11:30 PT, no count, no publication path).

## Update 2026-11-03 — Microsoft's post-mortem is the second firm's analysis: both 2.1.312 and 2.1.313 from Cursor's marketplace, never on the Visual Studio Marketplace or npm, and Anthropic told Microsoft its systems were not compromised

Microsoft Security Research published its analysis on 2026-10-30 (surfaced on Hacker News on 2026-11-02). It names "a tampered copy of Claude Code extension (anthropic.claude-code, versions 2.1.313 and 2.1.312)" served from the Cursor extension marketplace, repeats Cursor's window of about 2:27 AM to 1:35 PM PDT on 2026-10-29, and states that the packages "were never published nor distributed from Microsoft Visual Studio Marketplace" or from npm, which is the publisher's own confirmation of the marketplace facts the table above records. Anthropic told Microsoft that its systems were not compromised and that it did not develop the package, matching the staff statements in the 2026-10-31 update. Microsoft's file and startup locations to inspect are the ones already listed under "Am I affected?" (`authorized_keys` on each platform, the macOS LaunchAgent, the user crontab's `@reboot` entries, the Windows SysMon task and Startup entry, the `.smt`, `.smtk` and `.stk_` files), and it adds that the extension package itself should be preserved as evidence before cleanup. Its remediation order is the same as Cursor's: preserve evidence, isolate hosts with signs of execution, remove the extension, remove only the unauthorized key entry, inspect each startup object before removing it, stop the related processes, review telemetry for the window, rotate credentials and revoke sessions from a clean device when exposure is indicated, confirm nothing returns after a restart, and rebuild if needed. Microsoft does not name credential categories and does not say how the copies were published. Nothing changes in the table, the checks or `status`.

Cursor's notice, re-read 2026-11-03, still carries the 2026-10-30 11:30 PT update stamp and no publication path. The Microsoft Defender threat analytics report is titled for 2.1.313 alone; the post groups both versions as tampered without saying whether 2.1.312 carried a different payload or the same one.

Sources for this update: [Microsoft Security Blog — Inside the malicious Claude Code-branded Cursor extension with a persistent SSH backdoor](https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/) (fetched 2026-11-03: 2026-10-30, Microsoft Security Research; the two versions, the Cursor window, the Visual Studio Marketplace and npm statement, Anthropic's statement to Microsoft, the inspection locations and the remediation order); [Cursor — Claude Code extension security notice](https://cursor.com/blog/claude-code-extension-security-notice) (re-read 2026-11-03: "Anthropic.claude-code version 2.1.312 and 2.1.313 for Windows and MacOS", update stamp 2026-10-30 11:30 PT, no count, no publication path); Hacker News item 50332497 ("Postmortem on Claude Code Cursor extension hack", 8 points, 2026-11-02), read through the Algolia API 2026-11-03 for the link only.