Malicious Claude Code extension with SSH backdoor compromised Cursor marketplace, affecting 5,000 developers

According to The Register, a malicious actor uploaded a trojanized version of the Claude Code extension to Cursor's marketplace containing a persistent SSH backdoor targeting Windows, macOS, and Linux systems. The compromised extension (version 2.1.313) remained available for approximately 11 hours on October 29 before removal, exposing up to 5,000 developers. Anthropic stated the incident did not result from a compromise of its systems or employee devices, and that versions on official Anthropic channels were unaffected.