Malicious Claude Code Extension Found on Cursor Marketplace, Installing SSH Backdoor

A trojanized version (2.1.313) of Anthropic's Claude Code extension was distributed through the Cursor Marketplace, attempting to install a persistent SSH backdoor on user systems. The compromised package, active for approximately 11 hours on October 29, 2026, impacted up to 5,000 users before Cursor temporarily shut down its marketplace for removal. Anthropic has since released a clean version (2.1.314) on other platforms.