Backdoored Claude Code extension came from Cursor's own marketplace, not Open VSX

What we checked

• Can Anthropic and Cursor independently confirm the compromised artifacts, affected users, and required remediation steps? partly confirmed. Cursor confirmed the versions, window, hashes, IOCs and remediation scripts, and (per The Hacker News) an upper bound of 5,000 users. Anthropic has no advisory we could find; its position that its systems were not involved comes from staff forum comments, and its changelog skips 2.1.313 without explanation per Socket. [1][3][4]
• Was the trojanized 2.1.313 distributed through Open VSX, as the story says? refuted. Open VSX change-feed and npm history show no 2.1.313 release, and Cursor and The Hacker News place distribution only on Cursor's marketplace. A StepSecurity post still claims Open-VSX publication, but without a registry record. [4][3][1][5]

What we found

• Cursor's own security notice confirms that a maliciously modified Claude Code extension was served from the Cursor VS Code Extension Marketplace on October 29, 2026, between about 2:27am and 1:35pm PT. The notice, updated Oct 30, names two affected versions, 2.1.312 and 2.1.313, for Windows and macOS, and says Anthropic did not build them. So the story's version number is incomplete: 2.1.312 from Cursor's marketplace in that window is also listed. [1]
• Phorion's teardown shows the payload is an injected function that runs when the bundle loads, appends an attacker key labeled svc-telemetry to authorized_keys, opens a reverse SSH tunnel to 134.209.82.225, installs persistence (a LaunchAgent disguised as com.apple.sysmond on macOS, cron on Linux, a SysMon task or Startup script on Windows) and beacons host details. The beacon sends only environment variable names, not values. Phorion also documents a macOS bug that usually skips enabling Remote Login. [2]
• Cursor says turning on SSH needs admin rights the extension usually lacks, so on most hosts the attacker could not log in through the tunnel, and the attacker server has been taken offline. It still tells affected users to remove the key and persistence, consider rebuilding, and rotate credentials, since uninstalling the extension does not remove the dropped scripts. Cursor provides a grep check for svc-telemetry and remediation scripts for macOS and Windows. [1]

What it means

If your team uses Cursor, check every machine that installed or auto-updated Claude Code from Cursor's marketplace on Oct 29 between 2:27am and 1:35pm PT (09:27-20:35 UTC), for 2.1.312 as well as 2.1.313. Run Cursor's svc-telemetry check, remove the LaunchAgent, cron or scheduled-task persistence, and rotate credentials reachable from affected hosts; uninstalling the extension is not enough. Users who installed from Open VSX or Microsoft's marketplace are not known to be affected.

More broadly, a VS Code fork's marketplace is its own supply chain, separate from the publisher's. Pin extension versions, consider disabling auto-update for agent extensions with broad local access, and monitor IDE helper processes writing to ~/.ssh or launch-agent folders.

Competing readings

• An attacker abused Cursor's own marketplace publishing path to push a repackaged official extension (likely, about 75%). What would tell it apart: Only Cursor's marketplace served the build, during a bounded window [1][3]; No Open VSX release or Anthropic changelog entry exists for 2.1.313 [4]; Cursor audited access to its marketplace and found no other tampered extensions [1].
• Anthropic's build or publishing pipeline was compromised and the build leaked into Cursor's marketplace (very unlikely, about 10%). What would tell it apart: Cursor says Anthropic did not develop the malicious versions [1]; Anthropic's public GitHub releases and changelog skip 2.1.313 [4].
• The build was briefly published on Open VSX and mirrored into Cursor's marketplace (very unlikely, about 10%). What would tell it apart: Socket found no evidence 2.1.313 was publicly available on Open VSX [4]; Reporting found no evidence the update reached Open VSX or Microsoft's marketplace [3].

Base rate

The New Runtime archive holds only 1 earlier incident stories about companies, products or projects from the last 12 months that are at least 3 months old: too few (minimum 5) for a base rate. The archive has too few cases to give a base rate (1 case, 1 match, below the minimum of 5), so this conclusion does not lean on it.

What would change this view

• Open VSX or npm publishes a record or incident note showing 2.1.313 was released on their registry (signal): The distribution was wider than Cursor's marketplace and users of other VS Code forks may be affected.
• Anthropic or Cursor publishes a root cause pointing at Anthropic's signing or publishing credentials (signal): The compromise was in the publisher pipeline, not Cursor's marketplace.
• Cursor revises its affected-user count or reports confirmed inbound logins through the tunnel (signal): Real-world impact is larger than the failed-SSH analysis suggests.

Still open

• How did the attacker get a tampered build into Cursor's marketplace, and has Cursor published a root cause?
• How many of the up to 5,000 users actually had the key planted, and did any operator log in through a tunnel?
• Will Anthropic publish its own notice explaining the skipped 2.1.313 version?
• Why does StepSecurity still say the build was published to Open-VSX?