The compromised Claude Code extension appeared in Cursor’s marketplace at 5:27 a.m. ET on Thursday and remained available until 4:35 p.m.—a window in which as many as 5,000 people may have installed it, either manually or through automatic updates.¹

The tainted release, version 2.1.313, was distributed through Anthropic’s official Cursor account, according to independent researcher Kevin Beaumont and Phorian, a security firm. That made it more than a rogue upload: Phorian CTO Luke Roberts called it “a supply-chain compromise where the attacker gained access to the official distribution channel.”²

Once installed, the extension collected a broad inventory of a developer’s machine, including host and user names, operating system, home-directory path, public IP address, Git email and environment-variable names. It also attempted to place an attacker-controlled SSH key on the device, enable SSH and create a reverse tunnel—a route to persistent remote access across Windows, macOS and Linux.²

Researchers said coding errors meant the persistence mechanism would fail in some cases, particularly without administrator privileges. But Phorian warned that the malware still “installs persistence and beacons host reconnaissance back to the operator,” while the stolen variable names could help attackers identify cloud credentials and API tokens for follow-up attacks.²

Cursor’s response was to remove the package, block further distribution and work with the relevant cloud provider so infected machines could no longer reach the reverse-shell server. It also shut down its VS Code marketplace temporarily to rotate keys, audit access controls and verify that no other extensions had been altered; Cursor said it found none.¹

The unresolved question is how an attacker gained control of Anthropic’s official distribution channel. Neither Anthropic nor Cursor explained that breach, and Anthropic had not publicly warned customers, according to reporting on the incident.²