Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace

Cursor has confirmed that a malicious Claude Code extension labeled version 2.1.313 was available through its extension marketplace on October 29, potentially affecting up to 5,000 users. The disclosure identifies the distribution source behind a malware report initially attributed to Open VSX, where Socket’s investigation found no corresponding publication or removal records.

OpenSourceMalware initially reported that a malicious version of Anthropic’s Claude Code extension, 2.1.313, was published to the Open VSX registry. The analysis, written by Paul McCarty, described an unpacked macOS extension containing code that adds an SSH authorized key, attempts to establish a reverse SSH tunnel, and installs persistence. That article has since been substantially revised and no longer identifies Open VSX as the affected distribution channel.

The report also stated: “The provenance of the analyzed directory is not established.” It acknowledged that its findings do not independently demonstrate a compromise of Anthropic’s official distribution infrastructure. Socket has not obtained and analyzed the reported artifact.

Socket continuously monitors npm, Open VSX, and the VS Code Marketplace and automatically ingests newly published packages and extensions. Our ingestion systems did not capture version 2.1.313 from any of those registries, prompting us to investigate whether it had been publicly available.

Our review of registry records and its own ingestion logs has found no evidence that Claude Code version 2.1.313 became publicly available through Open VSX during the period examined. The version is also absent from the npm package’s current version and publication-time records.

These findings challenge reports that a malicious official release was briefly distributed and then removed. Open VSX’s public change feed records the neighboring releases, including all eight platform builds of each, but contains no publication or removal event for 2.1.313 in the window we reviewed. Public distribution of the reported artifact remains unsubstantiated.

Open VSX Has No Publication Record for 2.1.313#

Open VSX provides a registry changes feed designed to track versions becoming available, being deactivated, and being removed. Its append-only history is intended to retain events even after a version is deleted or purged.

We examined 3,392 returned events beginning October 27, 2026. The latest event in that completed review was timestamped October 30 at 05:35:23 UTC. The results included:

• ACTIVE events for all eight platform builds of 2.1.312.
• ACTIVE events for all eight platform builds of 2.1.314.
• No events for 2.1.313.

Under the documented behavior, a version becoming publicly available and subsequently being removed should leave a history. Its absence weighs against the explanation that 2.1.313 was simply published and quickly pulled.

Between October 27 and October 30 at 05:35 UTC, the same feed recorded 42 versions across 21 other extensions that were published and subsequently removed. Every version retained both events, including one removed approximately 90 seconds after publication. No corresponding publication or removal event appeared for Claude Code 2.1.313.

These observed removals show that even briefly available versions ordinarily leave a record. We found no such record for 2.1.313. Polling alone cannot exclude every short-lived event, which is why the registry’s retained change history is significant.

npm records also skip 2.1.313#

We queried the npm registry metadata for @anthropic-ai/claude-code. Version 2.1.313 was absent from both the versions object and the time map.

npm’s metadata retains publication timestamps for unpublished versions in the package’s time record. For example, the malicious Axios releases 1.14.1 and 0.30.4 were removed following the March 2026 compromise, but their publication timestamps remain visible:

npm view axios time --json | grep -E '"(1\.14\.1|0\.30\.4)"'

The absence of 2.1.313 from Claude Code’s time record therefore weighs against the explanation that it was published to npm and quickly removed.

The adjacent entries were:

This provides no support for a malicious npm release at 2.1.313. We are not treating absence from the current registry response as an absolute guarantee that no administrative action or attempted publication occurred.

The public GitHub releases and changelog likewise skip 2.1.313. The 2.1.314 changelog we reviewed contains no explanation of the missing version or notice of this reported incident.

A skipped number is not, by itself, evidence of a security event. Within the range 2.1.260 through 2.1.314, the current npm and Open VSX catalogs also omit 2.1.262, 2.1.264, 2.1.279, 2.1.297, and 2.1.298. Those gaps do not establish what happened to any particular build.

The screenshot does not establish the download history#

The initial report’s screenshot shows 2.1.313 selected as latest, with a “Published 3 hours ago” label. The post displays a cropped version; the full-size original also shows the "Target Platforms" panel. It displays Linux and Windows download sizesthat match the public 2.1.314 builds at the displayed precision.

We checked these against the 2.1.314 registry metadata and download lengths. Open VSX’s interface rounds file sizes to two decimal places, so matching displayed sizes do not prove identical files or screenshot manipulation. The analyzed sample is also described as a macOS build, while the fully visible sizes above concern other platforms.

Screenshot published by OpenSourceMalware showing Claude Code 2.1.313 labeled as the latest release on Open VSX. Its displayed Linux and Windows download sizes match version 2.1.314.

The relative publication label does not establish three hours of continuous public availability. Open VSX distinguishes a version’s original timestamp from its availability transitions.

The screenshot raised questions about whether it documented an actual public listing. It shows 2.1.313 as the latest release, but its displayed Linux and Windows download sizes match 2.1.314, and we found no corresponding publication event in Open VSX’s change feed. These discrepancies led us to suspect the image was edited or created for illustrative purposes. It has since been removed.

Cursor Publishes Remediation Guidance#

Cursor’s security notice identifies the affected version, provides hashes for the malicious macOS and Windows packages, and includes indicators of compromise and remediation scripts. Cursor says it removed the extension, rebuilt its marketplace after rotating keys, and worked with the hosting provider to take the attacker’s server offline. It is contacting affected users directly.

For organizations assessing exposure, the key question is whether developers installed or updated the extension through Cursor’s marketplace during the affected window. Socket’s investigation found no corresponding publication or removal records for 2.1.313 in Open VSX, and no entry in npm’s publication history. Cursor’s confirmation establishes a separate distribution path and gives security teams a specific marketplace, version, and installation window to investigate.