Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace

What it is

Socket's 30 October 2026 follow-up on the reported malicious Claude Code extension 2.1.313. OpenSourceMalware (author Paul McCarty) first said the version was published to Open VSX. The analyzed macOS build added an SSH authorized key, tried to open a reverse SSH tunnel, and installed persistence. That article has since been substantially revised and no longer names Open VSX. It also says the provenance of the analyzed directory "is not established". Cursor has since confirmed the extension was served from its own marketplace on 29 October, to up to 5,000 users.

How Socket checked Open VSX and npm

Socket read Open VSX's append-only changes feed: 3,392 events from 27 October 2026 to 30 October at 05:35:23 UTC. All eight platform builds of 2.1.312 and of 2.1.314 appear as ACTIVE. There are no events for 2.1.313.

The same feed shows the method works for short-lived versions. It recorded 42 versions across 21 other extensions that were published and then removed, and every one kept both events. One was removed about 90 seconds after publication.

For npm, @anthropic-ai/claude-code has no 2.1.313 in either the versions object or the time map. npm keeps publication timestamps for unpublished versions, as the Axios 1.14.1 and 0.30.4 releases show:

npm view axios time --json | grep -E '"(1\.14\.1|0\.30\.4)"'

GitHub releases and the changelog also skip 2.1.313, and the 2.1.314 changelog does not mention the incident.

The screenshot

The original screenshot showed 2.1.313 as latest, "Published 3 hours ago". Its Linux and Windows download sizes match the public 2.1.314 builds at the displayed precision. Socket says it suspects the image was edited or made for illustration. It also says Open VSX rounds sizes to two decimals, so a match does not prove identical files. The sample was a macOS build, while the visible sizes were for other platforms. The screenshot has since been removed.

What to do

Cursor's security notice gives the affected version, hashes for the malicious macOS and Windows packages, IOCs and remediation scripts. Cursor says it removed the extension, rebuilt its marketplace after rotating keys, and had the attacker's server taken offline. It is contacting affected users directly.

Socket's guidance for organizations is to find developers who installed or updated the extension through Cursor's marketplace during the affected window. Open VSX and npm are not the path to investigate.

Caveats

• Socket has not obtained or analyzed the artifact itself.
• Absence from the current npm response is not proof that no administrative action or attempted publication happened.
• A skipped version number is not evidence of an incident. 2.1.262, 2.1.264, 2.1.279, 2.1.297 and 2.1.298 are also missing from npm and Open VSX in the range 2.1.260 to 2.1.314.
• Polling alone cannot rule out every short-lived event.
• The page does not give the hashes, IOCs or scripts. They are in Cursor's notice.