Your extension inventory needs the download source

A compromised Claude Code extension in Cursor Marketplace shows why an extension inventory needs the download source.

Affected scope: installs or updates of Claude Code 2.1.312 and 2.1.313 from Cursor Marketplace on macOS or Windows, October 29, 2026, 09:27–20:35 UTC.

We explain what extension execution could trigger, why a download alone doesn’t establish execution, and what defenders should preserve and check. Cursor reported that errors and administrative requirements generally prevented SSH access. That finding doesn’t clear the remaining artifacts or establish that every affected machine is clean.

Read the sourced walkthrough at join.defensive.works.

Sources

• Cursor security notice

• StepSecurity investigation