Canonical event

Cursor discloses malicious Claude Code extension packages in marketplace on 29 October

Cursor's official October 29 security notice, updated October 30, identifies tampered Claude Code extension versions 2.1.312 and 2.1.313 distributed through Cursor marketplace for Windows/macOS during an approximately 11-hour period. Payloads sought SSH-key persistence and remote access; Cursor says it removed malicious packages, rebuilt marketplace and disabled attacker server. Source verifies supply-chain incident, not successful compromise of every install, Anthropic's official repository, or proven credential theft. Same underlying incident as existing RTS/Post-Cutoff research; do not count its corrected version list as a new second incident.