On October 29, 2026, OpenSourceMalware reported that Claude Code extension build 2.1.313 reached the Cursor Marketplace carrying an SSH backdoor inside a package that identified itself as Anthropic's. Claude Code 2.1.313 risk sits on the laptop that edits the site: if that PC installed the build, the passwords for your site may already sit on a machine an outsider can reach.
