HighMalicious packageupdated 30 Oct 2026, 10:24 UTC

Malicious Claude Code 2.1.313 extension removed from Cursor marketplace

Attacks reported (Socket)1 source, unconfirmed

Severity	HighMalicious package
Being exploited?	ReportedBy Socket, not officially confirmed yet
What to do	Remove itSee the steps below
How sure is this?	1 source, unconfirmedOnly one publisher so far, details may change

Timeline

30 Oct 2026, 09:26 UTC
Publicly disclosed
30 Oct 2026, 09:26 UTC
Reported by Socket · Socket
30 Oct 2026, 10:24 UTC
Picked up by Zero Radar

Sources 1 report, oldest first

Security researchers research teams and mailing lists

Cursor Removes Malicious Claude Code 2.1.313 Extension From Its MarketplaceSocket · 30 Oct 2026, 09:26 UTC

Technical details

ID: ZR-d3c49085
Disclosed: 30 Oct 2026, 09:26 UTC
On Zero Radar: 30 Oct 2026, 10:24 UTC (59 min after disclosure)
Last change: 30 Oct 2026, 10:24 UTC

This entry has not been explained yet. The text comes straight from the source. How Zero Radar works

Malicious Claude Code 2.1.313 extension removed from Cursor marketplace · Zero Radar