# Malicious Claude Code extension spreads through Cursor marketplace for 11 hours

> Original title: 11 小时影响约 5000 开发者：AI 编程工具 Cursor 官方商城出现恶意 Claude Code 插件

- Source: IThome · AI
- Published: 2026-10-31T05:36:34.000Z
- Bad Influence: https://badinfluence.news/items/f5c4wa3okbzv8hpfilqinabe8
- Original: https://www.ithome.com/1/020/466.htm

## Summary

Cursor's extension marketplace distributed a tampered Claude Code extension, version 2.1.313, for about 11 hours on October 29 and 30, potentially reaching 5,000 developers. The malware added a loader to extension.js that collected user and environment details and installed a persistent SSH backdoor. Cursor removed the extension, temporarily shut down the marketplace, and asked users to update to Claude Code for VS Code 2.1.314.

## Why it matters

The report gives the malware's persistence and data-theft behavior, plus Cursor's takedown and remediation steps, useful for developers checking whether they installed the affected extension.