Distributed under the official Anthropic publisher identity: a trojanized Claude Code extension in the Cursor marketplace

On October 29, 2026, the Cursor extension marketplace distributed trojanized Claude Code extensions 2.1.312 and 2.1.313 (macOS and Windows versions) under the legitimate identifier anthropic.claude-code, and they were taken down after about 11 hours online. The payload runs as soon as the extension loads, planting an attacker SSH key labeled svc-telemetry, establishing a reverse SSH tunnel to 134.209.82[.]225, installing persistence, and exfiltrating host reconnaissance information over plaintext HTTP; uninstalling or updating the extension does not remove these traces. Cursor stated that these builds were not developed by Anthropic and initially said that at most 5000 users were affected; Anthropic stated that its systems were not compromised and that versions on official channels such as Open VSX were not affected.