Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Anthropic released an emergency update to its official Claude Code extension, incrementing the software directly to version 2.1.314 to protect developers after unauthorized builds appeared in a third-party marketplace. The supply chain incident occurred on October 29 when attackers uploaded compromised packages to the Cursor VS Code Extension Marketplace, targeting engineers working across macOS and Windows workstations. Security researchers discovered that the rogue packages attempted host reconnaissance and sought to establish an unauthorized reverse network connection back to an external server. According to SecurityWeek's report, the malicious distribution stayed live for approximately 11 hours before maintainers caught the anomaly and took containment measures.

This technical report details the operational mechanics of the Cursor extension incident, how the malicious loader collected developer workstation configuration data, and the defensive controls that prevented deeper host compromise. The analysis is intended for engineering leads, system administrators, and software developers who run Cursor alongside Anthropic developer tooling on production workstations. It examines the timeline of the attack, the specific payload behaviors observed by Microsoft and Cursor security analysts, and the remediation steps required to eliminate persistent background artifacts. Readers will find exact version numbers, remediation commands, detection guidance, and indicators of compromise to audit local development environments.

What shipped in Malicious Claude Code Extension Served

The unauthorized packages uploaded to Cursor's extension store appeared under the identifier anthropic.claude-code, claiming version numbers 2.1.312 and 2.1.313. Neither package was created, verified, or published by Anthropic, which maintains official distributions strictly through designated registries. While legitimate releases deliver developer workflow integrations for Claude, these altered builds bundled an obfuscated JavaScript loader inside their modules. As soon as developer environments initialized the extension during standard module loading, the code activated an automated reconnaissance sequence. The routine scanned local workstation parameters, prepared automated file modifications, and attempted to execute operating system commands to prepare a backdoor into developer workstations across macOS and Windows operating systems.

Anthropic platform engineer Felix Rieseberg confirmed that a malicious actor abused marketplace access to distribute the counterfeit builds without Anthropic involvement. The official distribution pipelines, including Microsoft Visual Studio Marketplace, the Open VSX registry, and the NPM registry, remained untouched throughout the incident. Analysis by Microsoft revealed that the malicious JavaScript loader initiated host profiling before deploying secondary payloads. The code collected the active machine hostname, logged-in username, operating system release, system processor architecture, current working directory, and the developer's global Git email configuration. After completing initial discovery, a delayed callback mechanism scheduled an outbound transmission to deliver telemetry back to an attacker-controlled host.

What improved in Malicious Claude Code Extension Served

Anthropic responded to the compromise by issuing official version 2.1.314 to supersede the tampered sequence numbers and eliminate distribution ambiguity. Cursor intervened immediately upon discovery by removing versions 2.1.312 and 2.1.313 from its extension marketplace and taking the entire marketplace offline during its internal investigation. The platform team audited the registry catalog, verified that no other extensions suffered tampering, rotated all operational access keys, and rebuilt the repository infrastructure before restoring public access. Furthermore, Cursor collaborated directly with the external cloud provider hosting the attacker command infrastructure to shut down the upstream server, severing callback routes for any existing infections.

The rapid shutdown prevented attackers from maintaining active collection across the developer ecosystem. Security researcher Kevin Beaumont estimated that approximately 5,000 developer systems downloaded the tainted extension during its eleven-hour window on October 29. Because Anthropic incremented official builds to version 2.1.314, automated package managers and development clients cleanly bypass the fraudulent version range. Cursor stated that forensic inspection uncovered no evidence of compromise affecting other extensions or the official distribution channels. Platform infrastructure now operates on rebuilt services with newly provisioned credentials, significantly raising defensive baselines across the marketplace hosting architecture.

What you gain from Malicious Claude Code Extension Served

The primary protection for affected engineering teams emerged from fundamental operating system privilege boundaries. The malicious JavaScript payload was designed to install an unauthorized SSH key, activate local SSH services, establish a reverse tunnel, and set up persistent startup items. However, Cursor noted that enabling the local SSH daemon on both macOS and Windows requires administrative privileges. Because the extension execution context operates under standard developer user privileges, the service activation command failed on the vast majority of endpoints. This operating system constraint prevented attackers from achieving interactive login access through their planned reverse network tunnel.

Engineering organizations gain decisive forensic resources released by Cursor to audit and clean compromised workstations. Cursor published an official detection script alongside technical indicators of compromise to assist security operations teams in cataloging affected environments. The guidance emphasizes that simply deleting the extension from the IDE interface is insufficient, as the payload drops standalone persistence scripts and configurations that run independently of Cursor. Administrators can inspect process trees for rogue tunnel processes, remove unauthorized SSH keys, wipe scheduled startup items, and decide whether full system rebuilds are necessary for hosts showing signs of payload execution.

How to get Malicious Claude Code Extension Served

Developers running Claude Code must verify that their installation originates strictly from official upstream distribution channels and reflects release version 2.1.314 or later. Official releases are maintained directly via the NPM registry and authorized marketplaces, completely bypassing third-party catalog risks. Teams should verify installed package identifiers and update their globally installed command-line utilities using package managers. Upgrading ensures that local development configurations pull verified binaries built by Anthropic rather than unvetted community mirrors. Administrators should run updates across all developer environments to guarantee that outdated or contaminated build numbers are completely replaced by signed distributions.

npm install -g @anthropic-ai/claude-code

claude update

/model claude-fable-5-1

claude --model fable

export ANTHROPIC_MODEL=claude-fable-5-1

After updating the core binary, developers can manage runtime model selection directly within the active terminal interface. Typing the in-app command /model claude-fable-5-1 or /model fable switches model routing during interactive workflows. For continuous project sessions requiring a fixed model version, engineers can launch the interface pinned using the --model argument directly from their command shell. To enforce a uniform default across terminal reboots and build automation without specifying flags on every launch, developers can export their preferred model parameter in local shell profiles. These native controls ensure development workstations stay pinned to authenticated model configurations while operating on sanitized client binaries.

What to watch after Malicious Claude Code Extension Served

Security and infrastructure teams must actively monitor developer workstations for residual artifacts left by versions 2.1.312 and 2.1.313. Cursor explicitly warned that uninstalling the extension inside the editor does not eliminate dropped scripts. The loader was observed placing platform-specific persistence scripts and modifying startup configurations on both macOS and Windows systems. Incident responders must isolate any host demonstrating evidence of payload activity, terminate unauthorized background processes, remove rogue SSH public keys from authorized_keys files, and verify scheduled tasks or launch daemons. For hosts where execution progressed, rebuilding the operating system remains the recommended path to guarantee complete integrity.

Organizations must also audit identity credentials and developer metadata that may have been gathered during host reconnaissance. The malicious callback collected machine hostnames, internal usernames, working directories, and global Git email addresses, providing attackers with detailed organizational mapping. Security teams should cross-reference network logs against the indicators of compromise released by Cursor to verify whether internal machines attempted outbound callbacks to the attacker server before it went offline. Moving forward, engineering organizations should enforce strict registry filtering, preventing developer tools from sourcing extensions from unverified or mirror marketplaces that lack cryptographic publisher signing and validation checks.