Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace

Cursor removed a malicious Claude Code 2.1.313 extension from its marketplace.
The alleged version 2.1.313 was reported as potentially affecting up to 5,000 users.
OpenSourceMalware initially attributed the distribution to the Open VSX registry.
Socket’s investigation found no corresponding publication or removal records for 2.1.313 in Open VSX during the reviewed window (October 27–October 30, 2026).
npm metadata query showed version 2.1.313 absent from @anthropic-ai/claude-code’s versions and time map.
Open VSX change feeds for the reviewed period show active events for 2.1.312 and 2.1.314, but no records for 2.1.313.
The screenshot provided in the initial report showed Linux and Windows download sizes matching version 2.1.314.
Cursor confirmed removal of the extension, rotated marketplace keys, and worked to take down the attacker’s server.

The narrative unfolds through a collision between high-stakes alert (malware threat) and forensic nullity (no verifiable trace in standard distribution channels). The strongest available account is that Cursor confirmed an isolated distribution incident within its ecosystem, providing users with specific remediation parameters. The investigation, conversely, aggressively challenges the premise of widespread or long-term public availability via generalized repositories like Open VSX and npm, suggesting external reporting may lack primary evidentiary grounding.
This situation exposes a crucial pattern in modern supply chain security: the "Ephemeral Threat." A malicious artifact might exist only momentarily within a specific vendor's channel before rapid removal, making it invisible to broad, retrospective registry scans. The conflict here is between the *asserted impact* (a confirmed threat) and the *traceability data* (the lack of public historical markers). This dynamic forces security teams into a costly dichotomy: either trust the direct confirmation from the affected vendor (Cursor), or rely on external repository forensics (Socket).
The unstated assumption underpinning the initial reports was that any malicious release would leave an indelible footprint in public, indexed systems. The data challenges this assumption by demonstrating how cleanly an artifact can vanish from standardized logs. This raises questions about where truly zero-day or hyper-transient threats reside—outside of standard observability layers.
Does a vendor’s internal audit sufficiently indemnify against the risks introduced by unverified third-party initial warnings?
If external log systems are insufficient to capture brief malicious releases, what procedural safeguards should exist at the ingress point of commercial marketplaces?
How do platform users effectively balance rapid threat response based on anecdotal evidence versus waiting for verifiable chain-of-custody documentation?
Autonomy check: No autonomy signals.