Cursor discloses malicious Claude Code extension packages
Cursor identified compromised marketplace packages labelled Anthropic.claude-code; the malicious versions were not developed by Anthropic.
A familiar extension name can conceal an unfamiliar payload. Cursor disclosed malicious packages distributed through its extension marketplace, highlighting a trust boundary in AI-assisted development.
What happened
The 29 October notice identified packages labelled Anthropic.claude-code versions 2.1.312 and 2.1.313 for Windows and macOS. They attempted to establish persistent SSH access and collected host information.
Cursor said the malicious versions were not developed by Anthropic. It removed them, rebuilt the marketplace, rotated keys and worked to disable the attacker’s server. Its notice distinguished these packages from the official distribution.
Why it matters
Developer tools operate close to source code, working directories and credentials. A compromised extension can therefore create risks beyond the immediate editor session.
The incident also shows why package identity, distribution controls and trusted update paths matter alongside the security of the underlying AI model.
The bigger picture
Response needs to address what a malicious package executed, rather than assuming removal of the extension reverses every change. The broader commercial lesson is that AI coding environments need dependable supply-chain controls as adoption expands.