The report
Cursor disclosed that maliciously modified builds of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313, were available through its VS Code Extension Marketplace for part of October 29. The versions covered Windows and macOS. Cursor says the malicious code attempted host reconnaissance, SSH-key installation and reverse-tunnel persistence; those artifacts were not official Anthropic extension releases.
The distinction between a malicious attempt and a working backdoor is important here. Cursor's own notice says some persistence steps would ordinarily fail because of errors in the inserted code. Platform-specific SHA-256 values help identify suspect installed artifacts, but an installation count cannot be converted into a count of attackers' usable SSH sessions. Cursor's notice provides the affected time window and inspection guidance in its incident disclosure.
An independent registry review from Socket also disputed early assertions about Open VSX distribution. The correction does not negate the confirmed Cursor marketplace incident; it narrows what can be inferred about other publishing channels. The canonical Case preserves both observations. For affected installations, compare the installed VSIX hash to Cursor's specific affected builds and inspect persistence artifacts before treating a version label alone as proof of compromise.