According to CoinMeta, Cursor released a security incident report regarding a previous supply chain attack. Goplus analysis indicates that the attackers started with the access keys issued by Cursor to Fireworks, gradually gained access to some of SaaS and internal systems of Cursor, and ultimately contaminated the distribution cache of Claude Code. They collected user host information and implanted a SSH backdoor. The compromised versions were anthropic.claude-code 2.1.312 / 2.1.313 in the distribution cache of the Cursor VS Code extension market, affecting macOS and Windows systems. The risk period was from 17:27 on October 29th to 04:35 on October 30th (UTC +8), with up to approximately 5,000 users being affected.