{"artifact":{"id":"art-20261102-cursor","dedupe_key":"9948ee8974539e332c0b91045c893d468fcb3e79e4a18ca76d34c6d19a3c1ea6","canonical_url":null,"evidence_locator":"","artifact_type":"publication","title":"Cursor discloses malicious Claude Code extension packages in marketplace on 29 October","summary":"Cursor's official October 29 security notice, updated October 30, identifies tampered Claude Code extension versions 2.1.312 and 2.1.313 distributed through Cursor marketplace for Windows/macOS during an approximately 11-hour period. Payloads sought SSH-key persistence and remote access; Cursor says it removed malicious packages, rebuilt marketplace and disabled attacker server. Source verifies supply-chain incident, not successful compromise of every install, Anthropic's official repository, or proven credential theft. Same underlying incident as existing RTS/Post-Cutoff research; do not count its corrected version list as a new second incident.","creator_entities":[],"released_at":"2026-10-29T00:00:00.000Z","content_hash":null,"metadata":{"rts_finding_id":"rts_finding_c8754897d83d4684aa2e130f76eae5f4","epistemic_scope":"dated_official_milestone_or_publication","evidence_only":1,"source_bound":1,"no_civilization_snapshot":1,"no_relation_onset":1,"bounded_canonical_novelty_only":1},"created_at":"2026-11-02T11:42:54.752Z","updated_at":"2026-11-02T11:42:54.752Z"},"sources":[{"id":"src-20261102-cursor-1","dedupe_key":"9fb473181af05a6bc837350768b07f915e17123e78c3eafdf219817ea57f4e6e","name":"","publisher":"Cursor","url":"https://cursor.com/en-US/blog/claude-code-extension-security-notice","evidence_locator":"","source_type":"primary","primary_or_secondary":"","retrieved_at":"2026-11-02T11:36:55.965Z","published_at":"2026-10-29T00:00:00.000Z","author":null,"metadata":{"rts_finding_id":"rts_finding_c8754897d83d4684aa2e130f76eae5f4","epistemic_scope":"dated_official_milestone_or_publication","evidence_only":1,"source_bound":1,"no_civilization_snapshot":1,"no_relation_onset":1,"bounded_canonical_novelty_only":1},"created_at":"2026-11-02T11:42:54.744Z","updated_at":"2026-11-02T11:42:54.744Z"},{"id":"src-20261102-cursor-2","dedupe_key":"004fadd7c7fef443f0a6a49994cc32aaa51de66402a76a2635a82b1764ed00ed","name":"","publisher":"Microsoft Security Research","url":"https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/","evidence_locator":"","source_type":"primary","primary_or_secondary":"","retrieved_at":"2026-11-02T11:36:55.965Z","published_at":"2026-10-30T00:00:00.000Z","author":null,"metadata":{"rts_finding_id":"rts_finding_c8754897d83d4684aa2e130f76eae5f4","epistemic_scope":"dated_official_milestone_or_publication","evidence_only":1,"source_bound":1,"no_civilization_snapshot":1,"no_relation_onset":1,"bounded_canonical_novelty_only":1},"created_at":"2026-11-02T11:42:54.744Z","updated_at":"2026-11-02T11:42:54.744Z"}]}