On October 29, Cursor's extension marketplace served tampered builds of Anthropic's Claude Code extension, versions 2.1.312 and 2.1.313. They were live for about 11 hours. They added an attacker's SSH key to developers' machines.

Anthropic's systems were not breached. The official package was not breached either. The attacker, Anthropic said, "used access to Cursor's marketplace." In a statement quoted by BankInfoSecurity, Cursor said at most 5,000 users were affected.

To see how that is possible, follow the path an extension takes to your editor.

Delivery chain as described in Cursor's extension docs. The incident shows only that the copy Cursor's marketplace served was tampered with.

The delivery chain

Cursor is built on VS Code. It does not use Microsoft's extension marketplace. Its docs say it gets third-party extensions from Open VSX, an open extension registry.…