Cursor widens Claude Code extension alert to two builds

Cursor's revised security notice identifies two malicious Claude Code extension builds, 2.1.312 and 2.1.313, distributed through its VS Code Extension Marketplace, broadening the version check developers and security teams need to make after the October 29 incident.

The company now names macOS and Windows packages. It directs users who installed either identified build during the stated distribution window to investigate. The period, about 2:27am to 1:35pm Pacific time on October 29, corresponds to about 10:27–21:35 CET in Warsaw. Teams comparing installation records should retain the original time zone as well as the converted window.

“Uninstalling the extension may not be sufficient,” Cursor said in its security notice. The statement is issued by the Cursor Team, rather than an individually named spokesperson. Its significance is the distinction between removing an editor extension and removing changes that extension has already made to the operating system.

Cursor says the package attempted to establish persistent SSH access. Its account distinguishes the attempt to start a local SSH service from other changes: that service-start step usually failed without administrator privileges, but an unauthorised key, persistence files and host-information reporting could still be present. The company says the attacker server has been taken offline. Neither qualification establishes that an exposed workstation is clean.

For an engineering organisation, the first decision is which machines need investigation, not whether the extension still appears in the editor. A current extension inventory can miss a package that was installed and subsequently removed. Installation history and endpoint records answer the historical exposure question; inspection for persistence answers whether the operating-system changes remain. Those are separate checks and should not be substituted for one another.

The route of distribution also needs precise attribution. OpenSourceMalware's original artifact analysis says the malicious loader runs before the normal extension code. Its revised report identifies Cursor's marketplace, but explicitly limits what artifact inspection proves about the wider distribution infrastructure. Socket separately reported that its registry review found no corresponding 2.1.313 publication event on Open VSX in the window it examined. That finding is specific to that registry, version and review period.

These accounts do not support describing every Claude Code installation, npm package or Microsoft marketplace download as compromised. Package branding alone cannot establish provenance. The revised Cursor notice should guide the affected-version check, while the researchers' caveats should constrain claims about channels they did not independently establish.

Cursor's response guidance includes isolating hosts showing evidence of execution, removing unauthorised keys and persistence, assessing whether rebuilding is needed, and rotating reachable credentials from a trusted system. Security teams can use the company’s platform-specific indicators and remediation material rather than treating a generic uninstall as closure. The business exposure depends on what the affected account could access; the notice does not quantify a confirmed loss of customer data.

The practical consequence for European development teams is a broader, time-bounded investigation. Review both named builds, reconcile the historical record with the current machine state, and document why each host is cleared or escalated. An incident can be contained at the distribution service while individual machines still require remediation.

Sources

• Cursor — revised security notice — Primary source
• OpenSourceMalware — original artifact investigation — Primary source
• Socket — registry review and distribution caveats — Primary source