---
title: "Malicious Claude Code extension hits Cursor's marketplace"
date: 2026-10-30
updated: 2026-10-30T13:33:40Z
url: https://arun477.github.io/feed/2026-10-30/
author: Arun Arumugam
---

# Malicious Claude Code extension hits Cursor's marketplace

A tampered Claude Code extension in Cursor's marketplace tried to install an SSH backdoor on up to 5,000 machines; affected users should update and check for compromise.


- **Spike.** [Cursor pulls a malicious Claude Code extension from its marketplace](https://cursor.com/blog/claude-code-extension-security-notice) (Cursor, news, Security, 13:33 UTC): A tampered Anthropic.claude-code 2.1.313 sat in Cursor's extension marketplace for about 11 hours and tried to plant an SSH backdoor; up to 5,000 users got it. Update to 2.1.314 and check the listed indicators.