CryptoSlate
Cursor is urging developers who installed malicious Claude Code marketplace versions 2.1.312 or 2.1.313 on macOS or Windows to clean affected machines and rotate accessible credentials and sessions from a trusted system. The packages were available for about 11 hours on Oct. 29, 2026, according to Cursor, which says Anthropic did not develop them and reports no evidence that other versions or the official distribution were affected.
Uninstalling the extension may not remove components left behind. The malware analysis by security researcher Phorion says the payload can plant an attacker-controlled SSH key, enable remote login and create a reverse tunnel. It can also establish persistence through a macOS LaunchAgent or, on Windows, an attempted scheduled task with a Startup-folder fallback.
Why it matters
The extension’s injected code runs when Node loads its module, before the normal activation callback, so further interaction with the extension is not required. Successful remote access depended on host configuration and permissions: Phorion found that a macOS permission-check bug can prevent the payload from enabling Remote Login for a standard user, but an already-enabled SSH service could still leave a route in.
The initial beacon reportedly sent host information and up to 40 matching environment-variable names, not their secret values. Cursor cautioned that this does not rule out later credential access through the backdoor. The incident does not establish cryptocurrency theft or crypto-specific targeting, but credentials accessible to the affected local account could include developer or financial-service access.
Market impact
Cursor says it worked with the hosting provider to take the attacker’s server offline, removed the packages, rotated its keys and rebuilt and reopened the marketplace. Those steps do not clean machines where the extensions were already installed.
Cursor recommends reviewing endpoint, network and extension-installation records, isolating hosts that show payload execution or backdoor installation, and removing unauthorized SSH keys, persistence mechanisms and tunnels.
Frequently asked questions
-
Which Claude Code marketplace versions did Cursor identify as malicious?
Cursor identified Anthropic.claude-code versions 2.1.312 and 2.1.313 for macOS and Windows.
-
Why might uninstalling the extension not remove the threat?
The payload may leave an attacker-controlled SSH key, a reverse tunnel and persistence components such as a macOS LaunchAgent or a Windows startup mechanism.
-
What conditions affected whether attackers could remotely access a machine?
Access depended on host configuration and permissions. Phorion found that a macOS permission-check bug could prevent enabling Remote Login for a standard user, while an already-enabled SSH service could still permit access.
-
What information did the malware's initial beacon reportedly send?
Phorion said the initial beacon reported host information and up to 40 matching environment-variable names, not their secret values. That does not rule out later credential access.
-
Does the incident establish cryptocurrency theft or crypto-specific targeting?
No. Neither advisory establishes cryptocurrency theft or crypto-specific targeting, though credentials accessible to an affected local user could include developer or financial-service access.
WuBlockchain
TheBlock
CoinDesk
Lookonchain
CoinTelegraph