Cursor said a tampered version of the Anthropic.claude-code 2.1.313 extension was available in its extension marketplace between about 2:27 a.m. and 1:35 p.m. Pacific Time on October 29, affecting at most 5,000 users.

According to the company, the extension runs malicious code that collects data from the host computer and attempts to install a persistent SSH backdoor, with an attacker-controlled key, the local SSH service enabled and a reverse tunnel. Cursor said it removed the malicious version and blocked its distribution, and shut down the marketplace as a precaution, adding that the attacker's server is offline and there is no evidence other versions of the extension were affected. Reuters reported the removal and the blocking of distribution.