Claude Code Extension Compromised: The 2.1.313 Backdoor and 5 Steps to Check for and Remove It
On October 29, 2026, from 17:27 Beijing time until 04:35 the next day (about 11 hours), the official Claude Code extension in the Cursor marketplace was replaced with a malicious build containing an SSH backdoor. The affected versions were 2.1.312 and 2.1.313 on macOS arm64 and Windows x64. Cursor says up to 5,000 users may…
