Anthropic Confirms Tampered Claude Code Extension Hit Cursor Marketplace

Cursor removed the malicious version, blocked further distribution and briefly shut down its extension marketplace to rotate keys, audit access controls and confirm no other extensions were compromised. The marketplace has since reopened. Cursor also said it worked with the cloud provider hosting the server the reverse shell connected to so that infected devices could no longer reach it.

The attack was partly blunted by bugs in the malicious code itself. Researchers at Phorion and elsewhere noted the flaws prevented the backdoor from fully taking hold on many machines, though Phorion warned the malware still installs persistence and beacons host information back to the operator. Anyone who installed or updated the Anthropic VS Code extension from Cursor between 5:27 am ET and 4:35 pm ET on Thursday should treat their machine as affected. Updating to version 2.1.314 does not remove the backdoor, and both Cursor and Phorion have published indicators of compromise including IP addresses and cryptographic hashes.

If you use Cursor with the Claude Code extension, check your machine now rather than assume the clean version fixed things. Look for unexpected SSH keys, unusual startup items and outbound connections to unknown servers, and follow the remediation steps Cursor published. Rotating any cloud credentials and API tokens that were accessible from that device is the safer move given what the malware was built to collect.

For developers in Tunisia, the practical takeaway is the same as anywhere else: you do not need to be a target to be caught by a supply chain attack. Extension marketplaces auto-update by default, so a single compromised publishing account can reach thousands of workstations in a few hours. Neither Anthropic nor Cursor has said whether the incident will lead to changes in how extensions are reviewed or published, and there is no indication yet of any impact beyond Cursor users.