Malicious Claude Code 2.1.313
existed in Cursor's marketplace only

Cursor has confirmed that a malicious version 2.1.313 of Anthropic's Claude Code extension (Anthropic.claude-code) was available in its extension marketplace on 29 October 2026, from 02:27 to 13:35 PT (09:27 to 20:35 UTC). Cursor says it reached at most 5,000 users. Anthropic did not build it.

Early reports, first from OpenSourceMalware, said the version had also been published to npm, Open VSX and Microsoft's VS Code Marketplace. The registry records do not support that. We checked each registry, and compared Cursor's marketplace with the others.

Every real Claude Code release lands in four places

Each Claude Code release goes to npm as @anthropic-ai/claude-code, gets a tag and a release on GitHub, and is published as an extension to Open VSX and Microsoft's marketplace. The order and the spacing hardly change: npm first, the GitHub release within two and a half hours, Open VSX within three minutes of the release, and Microsoft's marketplace 12 to 15 minutes after that.

npm never published 2.1.313

npm keeps a publish time for every version ever published, including versions that were later removed. The time map for @anthropic-ai/claude-code goes from 2.1.312 straight to 2.1.314:

$ npm view @anthropic-ai/claude-code time --json | grep '"2\.1\.31[0-4]"'
  "2.1.310": "2026-10-23T21:20:46.540Z",
  "2.1.311": "2026-10-26T19:47:57.395Z",
  "2.1.312": "2026-10-27T18:36:10.160Z",
  "2.1.314": "2026-10-30T00:12:56.911Z"

real output, 30 Oct 2026; other versions trimmed

Our own npm feed agrees. It recorded 2.1.311 on 26 October, 2.1.312 on 27 October, and 2.1.314 at 00:13:05 UTC on 30 October, less than ten seconds after Anthropic published it. It never recorded a 2.1.313.

GitHub, Open VSX and Microsoft's marketplace skip it too

The GitHub repository has tags for 2.1.312 and 2.1.314, and none for 2.1.313:

$ git ls-remote --tags https://github.com/anthropics/claude-code 'refs/tags/v2.1.31*'
bd78b216ed563e57767901dcdd80f9a7750434c9	refs/tags/v2.1.31
b70dc4113ad72e0ee44f7b1b95afaf510b53ee98	refs/tags/v2.1.310
08c6a4f5121ae140d3c1b5c96e3e5ae53587b54b	refs/tags/v2.1.311
0e1f4789406477380b267a01f3ddd50b0211e5b3	refs/tags/v2.1.312
b3f291d131924810e2b7713ededc144843a229d5	refs/tags/v2.1.314

real output, 30 Oct 2026

Open VSX has no such version:

$ curl -s https://open-vsx.org/api/Anthropic/claude-code/2.1.313
{"deprecated":false,"downloadable":false,"error":"Extension not found: Anthropic.claude-code 2.1.313"}

real output, 30 Oct 2026

Microsoft's marketplace lists 2.1.312 and 2.1.314 and nothing between them. No public registry holds a release numbered 2.1.313.

A version in one marketplace only is the signal

Cursor's marketplace serves the same extensions as Open VSX, plus Microsoft's own builds of extensions that are published only on Microsoft's marketplace. It answers the same extension-query API as the other two, so the three can be compared directly.

On 30 October we did that for 26 widely used extensions, AI coding agents first. Cursor served 18 of them under their exact ID. For all 18, every one of the newest versions Cursor lists, up to 40 each, also exists on Open VSX or Microsoft's marketplace.

So a version that appears in a single marketplace, with no tag in the project's own repository, has no ordinary explanation. Version 2.1.313 was exactly that for eleven hours. A watcher that polls all three marketplaces at least hourly, and checks each new version against the upstream tags, flags it on the first poll.

What the malicious version did

From Cursor's security notice:

Check your machines

Cursor's check, macOS:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Windows (PowerShell):

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

Indicators

Source: Cursor's security notice.

What CyberXYZ checks

Our extension watcher read Microsoft's marketplace only, for a fixed list of widely used extensions that did not include Claude Code, so it did not capture 2.1.313. xyz Scanner's xyz audit ide lists the extensions installed in VS Code, Cursor, Devin Desktop (formerly Windsurf) and VSCodium and checks each version against the extension's own GitHub tags, but it could not read Claude Code's repository from its manifest and skipped it.

What changed on 30 October 2026:

• The watcher now reads Cursor's marketplace and Open VSX next to Microsoft's, and watches the main AI coding-agent extensions. A version seen in one marketplace with no upstream tag is flagged.
• xyz Scanner 1.4.79 reads the repository from any GitHub link in an extension's manifest. On a machine with 2.1.313 installed, xyz audit ide now reports it as a version with no upstream release.
• Machines that report their extensions to CyberXYZ Dashboard show Anthropic.claude-code 2.1.313 as malicious.