Install Claude Code and Verify It (After a Fake Extension)

To install Claude Code, run curl -fsSL https://claude.ai/install.sh | bash on macOS, Linux or WSL, or irm https://claude.ai/install.ps1 | iex in Windows PowerShell. Then run claude --version and claude doctor to confirm it worked. Install only from Anthropic's own installer, Homebrew, WinGet, npm (@anthropic-ai/claude-code) or the official VS Code extension.

By Gary, Greenlight My App · Updated Oct 31, 2026 · Last checked Oct 31, 2026, 6:53–6:58 AM ET · How we checked this: on a throwaway Debian Linux setup (separate home folders, not signed in), we ran Anthropic's native installer and the npm install of Claude Code 2.1.316, ran claude --version and claude doctor, verified the GPG-signed release manifest and checksum, and captured the VS Code Marketplace listing. We read Anthropic's setup docs, Microsoft's Oct 30 write-up and Cursor's security notice. We didn't have a Mac or Windows machine for this test, and we didn't test Claude Code's features. Drafted with AI tools and reviewed by a person before publishing.

On Oct 29, 2026, a tampered copy of the Claude Code extension was served in the Cursor extension marketplace for a few hours. Claude Code itself wasn't hacked, but the incident is a good reason to install it the boring way: from an official source, then check what you got. This guide covers both, plus how to check whether the bad extension touched your machine.

How to install Claude Code (the 60-second answer)

Open a terminal and run Anthropic's native installer. On macOS, Linux or WSL that's one curl command; on Windows it's one PowerShell command. When it finishes, open a new terminal and run claude --version. If you see a version number, it worked. Sign in the first time you run claude.

macOS, Linux and WSL:

curl -fsSL https://claude.ai/install.sh | bash

Windows PowerShell:

irm https://claude.ai/install.ps1 | iex

Windows CMD:

curl -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd

Tested: On Oct 31, 2026 we ran the Linux installer on a throwaway Debian setup. It printed "Claude Code successfully installed!", version 2.1.316, location ~/.local/bin/claude. It also warned that ~/.local/bin was not in our PATH. More on that in the errors section.

If you like to read a script before you run it, download it first, look at it, then run it. We recorded the checksum of the copy we ran so you can see the idea:

curl -fsSL https://claude.ai/install.sh -o install.sh
less install.sh
sha256sum install.sh
bash install.sh

The script changes over time, so your checksum won't match ours. The signed manifest in the verification section is the stronger check.

Install Claude Code on macOS, Linux and Windows

Every desktop OS has at least two official options: the native installer, plus a package manager (Homebrew on macOS, WinGet on Windows, apt, dnf or apk on Linux). Pick the native installer if you want automatic updates. Pick a package manager if your team already manages tools that way. There's no separate Claude Code download page to hunt for: each Claude Code install below pulls the official binary, and the Windows rows cover a Claude Code install on Windows with PowerShell or WinGet.

System requirements and the update notes come from Anthropic's setup docs (external), checked Oct 31, 2026. Anthropic also lists 4 GB or more of RAM.

macOS with Homebrew:

brew install --cask claude-code

Anthropic's docs say "claude-code tracks the stable release channel, which is typically about a week behind" (a claude-code@latest cask follows the newest releases), and "Homebrew installations do not auto-update." Run brew upgrade yourself. Our how to update Claude Code guide covers each method.

Windows with WinGet:

winget install Anthropic.ClaudeCode

We didn't have a Mac or a Windows machine for this test, so the macOS and Windows commands above come straight from Anthropic's docs, not from our run.

Install Claude Code with npm (and when not to)

You can install Claude Code with npm install -g @anthropic-ai/claude-code if you already have Node.js 22 or later. Anthropic says the npm package installs the same native binary as the standalone installer. Skip npm if you don't use Node, and never run it with sudo. The Claude Code npm package is the one to use: @anthropic-ai/claude-code.

node --version   # needs 22 or later
npm install -g @anthropic-ai/claude-code

Anthropic's docs are blunt about sudo: "Do NOT use sudo npm install -g as this can lead to permission issues and security risks." They also say that if npm --version starts with 12, you should follow their "Fix an npm 12 install" steps.

Tested: With Node v24.22.1 and npm 11.21.1, our first npm install added the package but skipped its postinstall step. npm printed an allowScripts warning that @anthropic-ai/claude-code@2.1.316 (postinstall: node install.cjs) was not yet covered, so no claude command appeared.

Re-running with the exact package allowed fixed it:

npm install -g --allow-scripts=@anthropic-ai/claude-code @anthropic-ai/claude-code
claude --version

Allow scripts for that one package name only. Don't turn install scripts back on for everything just to make one tool work.

Watch the package name

The real package is @anthropic-ai/claude-code: scope @anthropic-ai, with the "h". One sentence in Microsoft's write-up of this incident reads "@antropic-ai", which shows how easy a one-letter slip is. A look-alike name is a classic supply-chain trick, so copy the name from Anthropic's docs, not from a forum post.

You can check who publishes the package before you install it:

npm view @anthropic-ai/claude-code name version maintainers _npmUser

Tested: On Oct 31, 2026 that showed version 2.1.316, maintainers with @anthropic.com email addresses, and _npmUser = 'GitHub Actions <npm-oidc-no-reply@github.com>', meaning the version was published from a GitHub Actions workflow.

How do I verify I installed the real Claude Code?

Run claude --version and claude doctor first. Anthropic says a working install prints a version such as "2.1.211 (Claude Code)". For stronger proof, verify the GPG signature on the release's manifest.json and compare your binary's SHA256 checksum with the one in the manifest.

claude --version
claude doctor

Anthropic describes claude doctor as a command that "prints read-only installation and settings diagnostics without starting a session".

Tested: Our run printed 2.1.316 (Claude Code). claude doctor reported a native install on linux-x64, auto-updates enabled on the latest channel, and ended with "No installation issues found." It also noted we weren't signed in, which is expected because we never logged in.

Check the signed manifest

Anthropic's docs say: "Each release publishes a manifest.json containing SHA256 checksums for every platform binary. The manifest is signed with an Anthropic GPG key." Signatures are "available for releases from 2.1.89 onward."

Import Anthropic's key and check the fingerprint:

curl -fsSL https://downloads.claude.ai/keys/claude-code.asc | gpg --import
gpg --fingerprint security@anthropic.com

The fingerprint should be 31DD DE24 DDFA B679 F42D 7BD2 BAA9 29FF 1A7E CACE. Then download the manifest and signature for your version and verify:

VERSION=2.1.316
curl -fsSLO https://downloads.claude.ai/claude-code-releases/$VERSION/manifest.json
curl -fsSLO https://downloads.claude.ai/claude-code-releases/$VERSION/manifest.json.sig
gpg --verify manifest.json.sig manifest.json

Finally, compare your binary's checksum with the manifest entry for your platform:

sha256sum ~/.local/share/claude/versions/2.1.316
python3 -c "import json;print(json.load(open('manifest.json'))['platforms']['linux-x64']['checksum'])"

Tested: gpg reported a "Good signature" from Anthropic Claude Code Release Signing, with the fingerprint above, signature made Oct 30, 2026 at 7:49 PM ET. The binary's SHA256 (starting fd13c700 and ending a67d824) matched the manifest's linux-x64 checksum. gpg also printed "WARNING: This key is not certified with a trusted signature!", which Anthropic's docs say is expected.

On macOS and Windows, the binaries are also code-signed. Anthropic says macOS builds are signed by "Anthropic PBC" and notarized, and Windows builds by "Anthropic, PBC". "Linux: binaries are not individually code-signed", so use the manifest there.

codesign --verify --verbose ./claude

Get-AuthenticodeSignature .\claude.exe

Claude Code in VS Code and Cursor: which extension is real?

The official extension is "Claude Code for VS Code", identifier anthropic.claude-code, publisher Anthropic with a verified badge, on the Visual Studio Marketplace. Install it from inside your editor by that exact identifier, and check the publisher before you click Install.

In VS Code, open Quick Open (Ctrl+P) and run:

ext install anthropic.claude-code

Checked: On Oct 31, 2026 at 6:58 AM ET the marketplace page (external) showed publisher Anthropic (verified, anthropic.com), version 2.1.314, last updated Oct 29, 2026, and a requirement of VS Code 1.98.0 or higher.

To see which version you have installed in VS Code:

code --list-extensions --show-versions | grep anthropic.claude-code

Cursor uses its own extension marketplace. In Cursor, open the Extensions view, find Claude Code, and check the publisher and version number. If it shows 2.1.312 or 2.1.313, read the next two sections. For broader editor hygiene, see our Cursor security checklist and our post on AI coding assistant browser risks.

What happened with the fake Claude Code extension on Cursor?

On Oct 29, 2026, a tampered copy of the Claude Code extension, versions 2.1.312 and 2.1.313, was served in Cursor's extension marketplace for a few hours. Cursor says the bad versions targeted Windows and macOS and weren't made by Anthropic. Microsoft says the VS Code Marketplace and the npm package weren't affected.

Microsoft's Security blog (external) (Oct 30, 2026) put it this way: "On October 29, 2026, Cursor reported that a tampered copy of Claude Code extension (anthropic.claude-code, versions 2.1.313 and 2.1.312) was available and served in the Cursor extension marketplace for a few hours ... Cursor reports that it was live from about 2:27 AM to 1:35 PM Pacific Daylight Time (PDT)." That's about 5:27 AM to 4:35 PM ET.

Key facts, each from the named source (checked Oct 31, 2026):

Microsoft's advice for teams is worth copying: allow extensions only from approved publishers, and add a short cooldown before new extension versions install.

Was I affected? Checks for macOS, Linux and Windows

You're only at risk if you installed or updated the Claude Code extension in Cursor during the Oct 29 window and got 2.1.312 or 2.1.313. If so, run Cursor's check for an added SSH key, look for the persistence files Microsoft lists, and rotate secrets from a different, trusted machine.

Microsoft warns: "Removing or updating the extension does not remove artifacts written outside its installation directory." Cursor's notice (external) says much the same: uninstalling the extension may not be enough, because the payload leaves standalone persistence scripts running.

macOS. Cursor's check, word for word:

grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

Then look for the files Microsoft lists:

ls -la ~/Library/LaunchAgents/com.apple.sysmond.plist ~/.config/.smt ~/.config/.smtk

Linux. Cursor lists Windows and macOS as the affected platforms, but Microsoft also describes Linux artifacts: a user crontab @reboot entry plus files under ~/.config/.smt. These read-only checks show whether any are present:

grep -s svc-telemetry ~/.ssh/authorized_keys || echo "no svc-telemetry key"
crontab -l
ls -la ~/.config/.smt ~/.config/.smtk

Look for an @reboot line in crontab -l that you didn't add.

Windows (PowerShell). Cursor's check, word for word:

$files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

Microsoft also lists a scheduled task named SysMon, %USERPROFILE%\.config\smt.cmd, a smtk file and a sysmon.cmd in the Startup folder. To look for the task:

Get-ScheduledTask -TaskName SysMon -ErrorAction SilentlyContinue
Test-Path "$env:USERPROFILE\.config\smt.cmd"

Tested (partly): We ran the Linux-style checks on our clean throwaway setup before installing. The authorized_keys file didn't exist, so there was no match, and there was no LaunchAgents folder (that's a macOS path). The crontab command wasn't installed on that system, so our crontab check didn't run. On a real Linux machine, make sure crontab -l actually runs.

If any check finds something, treat the machine as exposed. Follow your security team's process, or Cursor's notice and Microsoft's write-up. Rotate API keys, tokens and passwords from a different, trusted machine. Our guide on what to do when an AI API key is stolen walks through rotation.

"command not found" and other install errors

"claude: command not found" right after installing almost always means the install folder isn't on your PATH yet. The native installer puts claude in ~/.local/bin. Add that folder to your shell config, open a new terminal, and run claude --version again.

Tested: Right after the installer finished, claude --version failed with "command not found" (exit code 127). After adding ~/.local/bin to PATH, it printed 2.1.316 (Claude Code).

The installer prints the fix itself. For bash, that's:

echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc && source ~/.bashrc

Use ~/.zshrc instead on a default macOS shell. Other common snags:

To remove a native install, Anthropic's docs list:

rm -f ~/.local/bin/claude
rm -rf ~/.local/share/claude

Do I need a paid plan to use Claude Code?

Yes. Installing is free, but using Claude Code needs a paid Claude plan or a Claude Console (API) account. Anthropic's docs say the free claude.ai plan doesn't include Claude Code access.

Anthropic's exact words: "Claude Code requires a Pro, Max, Ultra, Team, Enterprise, or Console account. The free claude.ai plan does not include Claude Code access." (Setup docs, checked Oct 31, 2026.) We didn't sign in for this guide.

For plan details, see is Claude Code free? and Claude Code pricing. Once you're in, read Claude Code permissions and sandbox before you let it run commands in a real project.

Before you ship what you build with it

AI coding tools write a lot of code fast, including config files and API calls. Before you launch, check what your live site exposes. Greenlight My App scans your public pages and JavaScript for secret key patterns (Anthropic, OpenAI, Stripe and more), exposed files like /.env and /.git, and missing security headers.

FAQ

Can you install the claude code? Yes. Run Anthropic's native installer (curl on macOS, Linux or WSL; PowerShell or CMD on Windows), or use Homebrew, WinGet or npm. Then run claude --version to confirm.

Is there a GitHub plugin for Claude Code? Yes. Anthropic offers Claude Code GitHub Actions. Run /install-github-app inside Claude Code, or add anthropics/claude-code-action to a workflow yourself.

Is claude CLI free? Installing it is free. Using it needs a Pro, Max, Ultra, Team, Enterprise or Console account; Anthropic says the free claude.ai plan doesn't include Claude Code.

Is the VS Code extension safe? Microsoft says the tampered versions were never on the VS Code Marketplace. Install anthropic.claude-code from publisher Anthropic, and check the publisher every time.

Was the npm package affected? Per Microsoft, no. The tampered versions were never published on npm. The real package is @anthropic-ai/claude-code; check the spelling before you install.

Which Claude Code extension versions were bad? Versions 2.1.312 and 2.1.313 of anthropic.claude-code, served by the Cursor extension marketplace on Oct 29, 2026, for Windows and macOS, per Cursor and Microsoft.

Is it enough to uninstall the bad extension? No. Cursor and Microsoft both say uninstalling may not remove what it wrote. Run the checks above and rotate secrets from a trusted machine.

Built something with Claude Code? Scan your app free with Greenlight My App to check your live site for exposed keys in public JavaScript, exposed .env and .git files, and missing security headers.