Cursor confirms both extension versions 2.1.312 and 2.1.313 contained malicious payload
cyb3rops · x · 2026-10-31
Security researcher mariusbenthin reports that Cursor updated its IOCs on Oct 30, correcting one hash and confirming that both versions 2.1.312 and 2.1.313, distributed through Cursor's extension marketplace, contained the malicious payload. The published IOCs list tampered VSIX SHA-256/MD5 hashes for darwin-arm64 and win32-x64, plus payload indicators: extension.js in both versions for Darwin and Windows contains a suspicious byte sequence and svc-telemetry-related code. Users on these versions should verify hashes and roll back.
More from coding & agent
- Tibo's 28 Days of Shipping: 8 Resets in 28 Days Reveals AI Coding Tool Instability — heypearlai · 2026-10-31
- Developer ships one AI-built micro app per day with Opus 5.5, launches a full collection on TikTok in under a month — ilumine_ai · 2026-10-31
- Codex now lets you take a photo mid-session on mobile — Dimillian · 2026-10-31
- Retro funding redesign: prediction markets cut reviewer load by only judging challenged projects — devanshmehta · 2026-10-31
- Using dot, Grok bot, or Claude Duet to watch a cluster is a surprisingly effective SRE strategy — sloppenheimer · 2026-10-31
- optimAIzr ships VS Code extension to track Claude Code usage, caches and limits — stichstichstich · 2026-10-31