Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Cursor removes tampered Claude Code 2.1.313 after up to 5,000 installs

9 sources · 9 articlesFirst reported Updated ()1
What's new

October 30: The Decoder reports Cursor restored the marketplace after taking it offline and neutralizing the malware, and said no other extensions were affected.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Cursor restored its marketplace after pulling tampered Claude Code 2.1.313, which may have reached 5,000 users.

A modified anthropic.claude-code 2.1.313 on Cursor’s marketplace and Open VSX ran a 66-line JavaScript loader when the extension loaded, not during a Claude chat. It added an Ed25519 key labeled svc-telemetry, tried a reverse SSH tunnel to 134.209.82.225, beaconed host details over HTTP port 8099, and set LaunchAgent, cron, scheduled-task, or Startup persistence. Cursor says it was listed about 11 hours on October 29 and may have reached 5,000 users; enabling SSH often failed without admin rights, but the key and beacon could still run. Anthropic’s Felix Rieseberg said Anthropic did not publish the package and its systems were not compromised. Kevin Beaumont says the official extension auto-updated in Visual Studio Code; Help Net Security and BleepingComputer say Microsoft’s marketplace never carried it. Cursor later restored the marketplace and said no other extensions were affected. Uninstalling does not remove dropped scripts.

Key facts
  • Affected build is anthropic.claude-code 2.1.313; Anthropic later published 2.1.314, The Hacker News reports.
  • Listing window was about 2:27 a.m. to 1:35 p.m. PT on October 29.
  • Beacon targeted 134.209.82.225 on SSH port 22 and HTTP port 8099.
  • Recon included hostname, username, OS, Git email, public IP, and up to 40 variable names, not values.
  • Cursor says it will contact impacted users; uninstalling does not clear dropped scripts.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026Version 2.1.313 listed from 2:27 a.m. to 1:35 p.m. PT. · BleepingComputer
  2. Oct 30, 2026OpenSourceMalware reports the tampered Open VSX package. · Cyber Security News
  3. Oct 30, 2026Cursor removes the build; version 2.1.314 is published. · The Hacker News
  4. Oct 30, 2026Rieseberg says Anthropic did not publish the package. · The Register
  5. Oct 30, 2026Cursor restores the marketplace after the takedown. · The Decoder

What each outlet adds

beyond the shared facts
  • The Hacker NewsNames the 2.1.314 replacement and says no follow-on payloads were seen.
  • Help Net SecurityA faulty macOS Remote Login check often skips enabling SSH.
  • The RegisterRieseberg denial, public-IP collection, key rotation, and server block.
  • Hacker NewsBeaumont says it auto-updated and has over 40 million installs.
  • The DecoderCursor later restored the marketplace after neutralizing the malware.
Vendors
AnthropicCursor
Products
Claude CodeVisual Studio CodeCursorOpen VSXClaude Code VS Code extensionVS CodeClaude Code for VS Code
Victims
Cursor
Organizations
PhorionEclipse FoundationMicrosoftOpenSourceMalwareOpen VSXAnthropic
AI models
Claude

Coverage

oldest first · one row per article · UTC
  1. · 11h ago Cyber Security NewsFirst report

    Malicious Claude Code extension on Open VSX plants an SSH backdoor

    OpenSourceMalware says anthropic.claude-code 2.1.313 adds an SSH key, reverse tunnel, and startup scripts; Anthropic’s official release is not shown compromised.

  2. · 10h ago GBHackers

    Trojanized Claude Code extension on Open VSX installs an SSH backdoor

    Version 2.1.313 beacons to 134.209.82.225 and plants an Ed25519 key; Anthropic’s Microsoft Marketplace build is not implicated.

  3. · 9h ago The Hacker News

    Malicious Claude Code VS Code extension installed an SSH backdoor

    Cursor says at most 5,000 users got version 2.1.313 on October 29; Anthropic replaced it with 2.1.314.

  4. · 8h ago Hacker News · security

    Backdoored Claude Code 2.1.313 shipped to VS Code and Cursor

    The build tried to plant a persistent SSH reverse tunnel before Anthropic replaced it with 2.1.314.

  5. · 7h ago Help Net Security

    Poisoned Claude Code extension on Open VSX planted an SSH backdoor

    Version 2.1.313 was on Cursor’s marketplace for about 11 hours; Cursor says at most 5,000 users were affected.

  6. · 6h ago oss-security

    Claude Code VS Code extension reportedly compromised on Open VSX

    The oss-security note says the Microsoft Visual Studio Marketplace copy was allegedly not affected, but the post is incomplete.

  7. · 4h ago BleepingComputer

    Malicious Claude Code extension on Cursor planted SSH backdoors

    Version 2.1.313 was listed for about 11 hours on October 29 and may have reached 5,000 developers.

  8. · 2h ago The Register · Security

    Tampered Claude Code extension on Cursor planted an SSH backdoor

    Version 2.1.313 was downloadable for about 11 hours and could have reached up to 5,000 developers; official Anthropic channels were not affected.

  9. · 38m ago The Decoder

    Tampered Claude Code extension in Cursor marketplace stole host data

    Cursor says the listing was live about eleven hours and may have reached 5,000 users before the marketplace was taken offline.