According to CryptoSlate and Cursor's official security advisory, tampered installation packages for Anthropic.claude-code versions 2.1.312 and 2.1.313, targeting macOS and Windows, were available in the Cursor extension marketplace on October 29. Cursor stated that the malicious versions were not developed by Anthropic, and there is no evidence to suggest other versions or official distribution channels were affected. Simply uninstalling the extension may leave persistent components; Cursor advises affected users to inspect and clean their hosts, and to rotate relevant credentials and sessions from a trusted system. The report did not confirm any cryptocurrency theft or attacks specifically targeting cryptocurrencies.