A trojanised version of Anthropic's official Claude Code extension — version 2.1.313, shipped under the extension's legitimate publisher identity — was distributed through Cursor's IDE marketplace and attempted to install a persistent SSH backdoor on affected systems. Cursor temporarily shut down the marketplace to remove the package, saying the incident "impacting at most 5,000 users", and asserting the malicious version "was not developed by Anthropic"; researchers noted the attackers still distributed it under Anthropic's legitimate extension ID. The campaign is tracked in the open-source malware layer: the human-verified OSM archive holds the record — anthropic.claude-code (vscode) 2.1.313, rated critical, first seen 30 October 2026 (OSM record). It is one of seven new malicious marketplace rows this window — mostly VSCode-extension typosquats (Markers.markersboard, hardhat-soliditiy lookalikes) and npm packages (orderbook-volt-plugin, postcss-motion-helpers) — reinforcing that extension marketplaces are now a primary vector against AI-coding developer workflows.

• Source article