Security notice — malicious version of Anthropic.claude-code (2.1.312 and 2.1.313) identified in the Cursor VS Code Ext…
Cursor identified a malicious Claude Code extension version that attempted to collect host details and install persistent SSH access; affected users should check and remediate their machines.
Cursor says the malicious **Anthropic.claude-code 2.1.313** package was available in its VS Code extension marketplace on October 29, 2026, and may have reached **up to 5,000 users**. It collected host details and attempted to add an SSH key, create persistence, and open a reverse tunnel; the attacker server is now offline.
If you installed that version from Cursor's marketplace during the stated window, check for the `svc-telemetry` SSH key, investigate and remediate persistence, isolate hosts showing execution, and rotate credentials from a trusted system. Uninstalling the extension alone may not remove its scripts.
Cursor says the malicious **Anthropic.claude-code 2.1.313** package was available in its VS Code extension marketplace on October 29, 2026, and may have reached **up to 5,000 users**. It collected host details and attempted to add an SSH key, create persistence, and open a reverse tunnel; the attacker server is now offline. If you installed that version from Cursor's marketplace during the stated window, check for the `svc-telemetry` SSH key, investigate and remediate persistence, isolate hosts showing execution, and rotate credentials from a trusted system. Uninstalling the extension alone may not remove its scripts. Cursor says it found no evidence that other versions or Anthropic's official distribution were affected. The server outage blocks the reported connection, but does not remove artifacts already installed on a machine.
This is a concrete extension supply-chain incident with a named malicious version, a bounded marketplace exposure window, and remediation steps for possible host compromise. Cursor reports no evidence against other versions or Anthropic’s official distribution, but uninstalling alone may leave installed persistence artifacts, so affected hosts need investigation and credential rotation from a trusted system.