Skip to content
EVENT / TOPICWatching

Cursor recalls malicious Claude Code versions, urges credential reset

1 reports1 sources11/1/2026 updated

Current overview (not historical)

AI overview

Cursor has recalled Claude Code marketplace versions 2.1.312 and 2.1.313 after discovering they contained malicious code. The company warns macOS and Windows users to clean their hosts and rotate credentials and sessions to prevent ongoing remote access. Successful remote access depends on SSH configuration and host permissions. The incident follows the discovery of the compromised versions in Cursor's marketplace.

Written with AI from the reporting · updated 11/1/2026

Latest developmentNov 2, 02:40
Cursor urges credential resets after malicious Claude Code marketplace update
Explore the timeline, relations and evidence
Expand the detailed fact route and sources

Story route

A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.

  1. 1Unclassified fact stationNov 2, 02:55single sourcereport-time onlyrevised

    Cursor urges credential resets after malicious Claude Code m

    Read original source ↗ CryptoSlateReplay this moment in the explorer
    Evidence & revisions · 1 source records
    Occurred (fact side)：
    not recorded
    CryptoSlate ↗Report pageRevision 2 · currently revised
    Published (valid side)：
    Nov 2, 02:40
    First seen (known side)：
    Nov 2, 02:55
    Fact stationSingle source · one-sided claimRevisedReport-time only

    Copy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.

Uncertainty marks flag where to check the sources; they are not proven causation.

Report timeline

Explore every side through dated source reports.

Nov 2
  1. CryptoSlateRelated fact: single sourceFact occurrence time unverifiedSource report revised
    Cursor urges credential resets after malicious Claude Code marketplace update

    Report first recorded Nov 2, 02:55

    Cursor identified malicious Claude Code extension versions 2.1.312 and 2.1.313 in its marketplace, affecting macOS and Windows users. Uninstalling the extension may leave persistent components behind, and successful remote access depended on SSH configuration and host permissions. Cursor recommends cleaning affected machines and rotating accessible credentials and sessions from a trusted system.

    Read original source ↗

Event activity trend

Latest comparable
3
Comparable peak
10Nov 2, 03:00
24h change
-51%

The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.

Event discussion

Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.

Open GitHub Discussions