Cursor: Malicious Claude Code Extension in VS Code Marketplace Carried SSH Backdoor for 11 Hours
Cursor confirmed that weaponized builds of the Claude Code extension briefly appeared in its Visual Studio Code extension marketplace on October 29, 2026. For roughly eleven hours those tampered packages attempted to harvest host details and install an SSH backdoor intended to provide persistent remote access. Cursor says the compromised builds were not produced by Anthropic and that distribution was limited to specific versions of the extension. Timeline and affected…