Trojanized Claude Code v2.1.313 hits Cursor marketplace, up to 5,000 users exposed
therealdanvega · x · 2026-10-30
Cursor confirmed a trojanized Anthropic.claude-code v2.1.313 in its marketplace, live Oct 29 from 09:27 to 20:35 UTC, affecting up to 5,000 users across macOS ARM64 and Windows x64 builds.
The author's warning: AI coding tools touch your repo, terminal, and keys — treat their updates like dependencies:
- Pin versions; turn off auto-update for extensions that run shell commands
- Check the publisher before installing
- If you installed that version, rotate your SSH keys
More from coding & agent
- Claude subscriptions are back in opencode, restoring sub-based coding access — threepointone · 2026-10-31
- RSNA review: LLM agents show promise for radiology but need multilayered evaluation — Michael_D_Moor · 2026-10-31
- "I don't think the world needs a new GitHub": GitHub leaders on AI-era rivals — rseroter · 2026-10-31
- Guizang's voice-profile skill learns your tone from DeepSeek chat logs to de-AI your writing — op7418 · 2026-10-31
- rTaste: 415 experiments show frontier research agents' rankings barely beat a random pick — omarsar0 · 2026-10-31
- Open-source image-to-3dlab fixes garbled text in image-to-3D, runs fully locally — Scobleizer · 2026-10-31