Swarm Rebuild Is Not the Cursor Marketplace Attack

Swarm Rebuild’s public repository had 4 commits on 10 November 2026, and none publicly links it to the separate Cursor marketplace incident. Its latest listed commit changes a README demonstration image, not a security response or editor extension package.

FuturPulse analysis · 10 November 2026

Was Swarm Rebuild involved in the Cursor incident?

No public evidence presented here connects Swarm Rebuild to that incident. The project’s repository describes a Chrome extension that takes the current page, blanks it visually, then rebuilds its appearance with animated cursor agents.

The extension is designed for visual effects and screen recordings. Its README says it snapshots a live document object model, or DOM, which is the browser’s structured representation of a page.

The Cursor reports refer instead to a marketplace for editor extensions. One incident account identifies modified Claude Code versions 2.1.312 and 2.1.313. That is a different application category, distribution channel and codebase.

This distinction matters because an IDE extension can inspect projects and invoke local tools. Swarm Rebuild, by contrast, is packaged as a browser extension.

A browser add-on can still handle sensitive page content. That fact does not make it part of a workstation persistence attack.

The table compares the public project record with the separate marketplace report. It shows different software, different distribution routes and different evidence.

What did Swarm Rebuild promise to do?

Swarm Rebuild promises a visual reconstruction, not an interactive copy of the page. Its README says the extension snapshots a live DOM into a blueprint.

That blueprint can represent boxes, text, lines, images and other page elements. The animated cursors then rebuild the page inside a separate visual layer.

Users start the extension from the toolbar or with Alt+Shift+S, according to the project README. The same documentation describes Tour mode, sound effects and build speeds of 1×, 2× and 3×.

The project says the original page scripts do not run inside the visual rebuild. Web components become plain styled elements rather than working components.

That promise creates a privacy boundary worth understanding. The extension puts what is visible on a page into an animation.

A draft message, address or search query visible in a form can therefore appear in a recording. That can happen even if the extension does not send the information elsewhere.

What actually shipped in the public repository?

The public history is short. GitHub lists 4 commits in the Swarm Rebuild repository.

The most recent public commit, 3d49e0a, was made by the account chipthebot on 6 November 2026. Its message says it uses a smaller animated WebP for the README demonstration.

That visible change narrows a claim sometimes lost in discussion of the separate Cursor attack. The commit is described as a README asset change, not as a package update, permissions expansion, network feature or remediation release.

Swarm Rebuild’s source also credits the earlier Swarm web project by Joel Califa. The initial public Swarm site commit was dated 14 October 2026 and was titled “Publish built Swarm site.”

The extension README says it adapted substantial animation concepts from that site. It adds the browser-extension layer that points the effect at arbitrary pages.

What is the timeline of the two projects?

The timeline below separates public project history from the marketplace story. It does not infer that similar names, overlapping dates or search-result placement establish a technical relationship.

What permissions does the Chrome extension use?

Swarm Rebuild declares activeTab and scripting, according to its README. Chrome says activeTab grants temporary access to the tab a user explicitly invokes.

That access lasts while the user remains on the page. Chrome says access is revoked when the user navigates away or closes the tab.

The second permission lets the extension inject its page-rebuild code into the chosen tab. Chrome’s documentation says that an extension with activeTab and scripting can execute code in the activated page and read temporary tab details such as its URL and title.

This is narrower than a persistent all-sites permission. It remains meaningful access because the intended product function requires the extension to inspect and reproduce page content.

For a reader deciding whether to install it, the important question is not only how long the permission lasts. It is what appears on screen when the toolbar button or shortcut is used.

Did the published code show data theft or remote loading?

A 7 November review of the public main branch reported no visible fetch(), XMLHttpRequest, WebSocket, remote-code loader or browser-storage call in the central page script.

The same review described a background script that can capture a tab image when visible media needs to be represented in the animation. Those observations are useful, but they are not a complete security audit.

The public code review says Swarm Rebuild’s privacy notice claims that it collects, stores and sends nothing. The review also says a screenshot used for media reconstruction stays in memory.

Neither statement verifies that a Chrome Web Store package is bit-for-bit identical to the GitHub repository. The project README itself warns that the store version can lag behind the repository while an update is under review.

That gap is the practical security issue. A readable public repository can help a user assess source code, but browser stores distribute packaged artifacts.

Before trusting a new extension on private pages, an organisation needs the publisher identity, the precise package version and a way to compare the installed artifact with reviewed source.

What can the rebuilt page expose?

The extension’s own documentation says it rebuilds forms as visual elements. A field that contains text can therefore be reproduced in the animation rather than remaining hidden from the person watching it.

FuturPulse’s review says the code copies current input values into the rebuilt layer. It reports that password fields are replaced by dots, while an empty field shows its placeholder text.

The rebuilt page is not a working form. The review says the code strips contenteditable settings, inline event handlers and autofocus from the copies.

The practical risk is what the user shows. A draft email, search query or address typed into a page can appear in the animation or its recording.

A password may show only as dots, but those dots can reveal its length. Nothing in the main-branch code reviewed by FuturPulse suggested that the captured content leaves the machine.

How does the Cursor incident change the advice?

The Cursor incident changes the baseline for checking extension provenance, not the factual status of Swarm Rebuild. Incident reporting describes modified Claude Code extensions 2.1.312 and 2.1.313 in Cursor’s marketplace.

A BornSec threat-advisory summary describes the packages as carrying a persistent SSH backdoor. Another report says the payload added an SSH key, installed persistence and reported host details.

The incident reports also say SSH setup often failed without elevated privileges. That limited the attack on many systems, but it did not make an executed package safe.

Those allegations should not be pasted onto unrelated browser software. They are a sound reason to separate browser extensions from coding extensions and to record installation times.

• Use Swarm Rebuild only on pages whose visible content is safe to replay in a video.
• Do not assume the GitHub project and a store listing are identical without a package comparison.
• For Cursor users, check installed extension identifiers and installation times against the affected product’s incident guidance.
• Do not delete suspected IDE malware and assume the workstation is clean if persistence may have been attempted.

Cursor’s incident guidance says uninstalling the extension alone may leave persistence. It recommends checking SSH keys and persistence indicators, isolating hosts with execution evidence and rotating reachable credentials from a clean system.

That advice applies to Cursor users who may have run the affected editor package. It is not evidence about Swarm Rebuild.

What should organisations check before installing it?

Start with the manifest and the publisher. Confirm the permissions, the package identity and the source revision before allowing the extension onto pages that contain confidential information.

Then compare the installed artifact with the reviewed repository when the project provides a build process. Swarm Rebuild’s README says users can load the latest code unpacked, while warning that the store version can lag behind the repository.

For a public demonstration page, the risk is mainly exposure through the visual replay. For a work account, a customer portal or a page with private drafts, the safer choice is not to activate the extension.

Developers should also check the licence before copying the code. The repository says it has no licence and asks readers to check with Joel Califa before reusing adapted code.

What we could not verify?

No public official statement from Cursor or Anthropic in the evidence cited here names Swarm Rebuild, its repository owner or its contributors. Cursor and Anthropic could settle that question with an incident report naming affected package identifiers, publisher accounts, hashes and distribution paths.

It is also not publicly verified here that the Chrome Web Store build matches the latest GitHub commit. The extension publisher could settle that with reproducible build instructions, a signed release archive and hashes for the store package.

The available record supports a narrower conclusion. Swarm Rebuild is a browser-animation extension, while the Cursor incident involved modified Claude Code packages in an editor marketplace.

Those products have different permissions, distribution paths and codebases. No public evidence presented here ties Swarm Rebuild to the Cursor marketplace attack.

Sources

• DhvanilPatel/swarm-cursors repository
• Swarm Rebuild commit 3d49e0a
• Chrome activeTab permission documentation
• Swarm Rebuild code and permission review
• Cursor marketplace incident coverage
• BornSec threat-advisory summary