A tampered Claude Code extension reached Cursor's marketplace

Cursor says two versions of the Claude Code extension in its marketplace (2.1.312 and 2.1.313, for Windows and macOS) had been tampered with and weren't built by Anthropic. They were available for about 11 hours on 29 October, roughly 09:27 to 20:35 UK time, and Cursor says up to 5,000 users may be affected. The bad versions sent off computer details, added an attacker's SSH key named 'svc-telemetry' and tried to keep themselves installed. Version 2.1.314 fixes it, but uninstalling isn't enough: Cursor's notice explains how to remove the planted key and leftovers. Microsoft's VS Code Marketplace wasn't affected.

Why it mattersTreat AI extensions, plugins and skills like any other software: check versions, keep a list of what's installed on each laptop, and if your team uses Cursor, follow the clean-up steps today.

Curated by Sara Simeone as part of our human editorial coverage. The original sources are linked below; curation is distinct from a Hype or Fact? assessment.

How we knowCompany figures are labelled as their own claims; anything we couldn't verify is labelled as a report or a claim.