People who installed the malicious Claude Code extension from Cursor’s marketplace should check the computer itself, even after removing or updating the extension. Microsoft’s analysis says the malware can leave startup scripts and unauthorized SSH access keys outside the extension’s folder.
Cursor’s security notice identifies Windows and macOS versions 2.1.312 and 2.1.313 of anthropic.claude-code distributed through its VS Code Extension Marketplace between about 2:27 a.m. and 1:35 p.m. Pacific on October 29. The malicious packages were not developed by Anthropic, Cursor says.
The company removed the packages, rebuilt its marketplace and worked with the hosting provider to take the attacker’s server offline. Those steps do not remove files already written to a user’s computer.
What affected users need to check
Microsoft Security Research’s October 30 analysis describes code that collects computer and user information, attempts to add an attacker’s SSH key and tries to establish a persistent remote-access tunnel. It sends selected environment-variable names, not their stored values. That collection alone does not establish that passwords or API keys were stolen.
Successful remote access depended on permissions and configuration. Cursor says coding errors and administrator-permission requirements blocked that access on most Windows and macOS computers, while malicious keys and startup files could still remain.
Microsoft recommends reviewing installation records and security logs, preserving evidence before cleanup and isolating devices showing malicious execution or backdoor installation. A missing SSH-key marker alone does not establish that a computer is clean. Organizations should have their IT or security team investigate affected work devices.
Cursor provides platform-specific checks and cleanup scripts in its notice. Users should review those requirements before running them. The company also advises replacing accessible credentials and sessions from a trusted computer.
Microsoft says the malicious packages were not distributed through Microsoft’s Visual Studio Marketplace or the official npm package. Ars Technica reported Friday that the initial access method remained unexplained.
