Cursor urges credential resets after malicious Claude Code marketplace update

Code editor Cursor is urging developers who installed malicious Claude Code extension packages from its marketplace to clean affected machines and rotate accessible credentials and sessions from a trusted system. Removing the extension alone may leave persistent components running, the company warns.The affected packages are Anthropic.claude-code versions 2.1.312 and 2.1.313 for macOS and Windows. Cursor’s security notice places their availability between about 2:27 a.m. and 1:35 p.m. PT on Oct. 29, 2026. Cursor says Anthropic did not develop the malicious versions and reports no evidence that other versions or the official distribution were affected.Cursor clarified the affected versions and indicators on Oct. 30. Security researcher Phorion updated its malware analysis on Oct. 31 to include both versions, having initially identified only 2.1.313.Why uninstalling may leave access behindAccording to Phorion, the payload attempts to add an attacker-controlled SSH key, enable the machine’s SSH remote-login service and establish a reverse tunnel. With SSH running, the planted key could let an attacker log in through that tunnel. Persistence mechanisms include a macOS LaunchAgent and, ...