A familiar extension name can make installation feel routine. It does not, on its own, establish where the installed package came from. Cursor has confirmed an incident in its marketplace involving tampered Claude Code extensions. Its updated notice identifies versions 2.1.312 and 2.1.313 for macOS and Windows, distributed on October 29.
Cursor says the malicious packages were not developed by Anthropic. The scope matters: this is confirmation about an identified channel and packages, rather than evidence that every Claude Code distribution was compromised.
Removing an extension may leave work unfinished
Phorion's technical analysis, updated on October 31, describes code attempting to arrange remote access through SSH and keep components running outside the extension. SSH is a legitimate remote access mechanism; the reported behavior sought to make that access available to an attacker.
Removing an entry from the extension list is therefore different from establishing that an incident is over. If a package placed independent components on the system, uninstalling the original package does not demonstrate that those components disappeared. That is the practical reason to investigate the computer, rather than simply check the editor's extension list.
The researchers also identified implementation errors and privilege requirements that limited parts of the attempted access. Those constraints help establish impact, but do not show that every machine which ran the package remained untouched.
Establish the distribution channel before deciding the response
Cursor's notice calls for remediation beyond uninstalling and says the malicious server has been taken offline. For a team, the first useful task is a reliable installation inventory: version, source, time and evidence of execution.
An inventory that records only “Claude Code installed” leaves too much unresolved. Two people may use the same product through different distribution channels. Treating both as equally affected can create unnecessary work; overlooking that distinction can also leave a relevant machine out of the investigation.
Operational decisions should follow the current official advisory and its indicators. Administrators need to assess the traces they find and the credentials accessible from the host, alongside the security team handling the response. We do not reproduce cleanup scripts here because their application depends on the platform and the machine's condition.
Trust has to reach the installed package
The incident makes a software supply chain issue tangible: recognizing the vendor is only one part of verification. Package identity, distribution source and behavior after installation matter too.
Teams using AI development tools should preserve those records before updates or cleanup erase useful history. Closing the investigation requires more than knowing that a bad package left the marketplace. It requires establishing that the affected machine is back in a state the team can trust.