Backdoored Claude Code Extension Impacts Thousands of Cursor Users with SSH Backdoors

A malicious version of Anthropic's Claude Code extension for Cursor, specifically versions 2.1.312 and 2.1.313, was distributed through the Cursor Marketplace, installing SSH backdoors on approximately 5,000 developer systems. The attack appended an Ed25519 key to `~/.ssh/authorized_keys`, established a reverse SSH tunnel, and created persistence mechanisms on macOS, Linux, and Windows. Users are advised to check for specific files and block egress to a malicious IP address.