Trojanised Claude Code Update on Cursor’s Marketplace Tried to Plant SSH Backdoors on Up to 5,000 Developer Machines

A tampered Claude Code extension was served through Cursor’s marketplace for nearly 11 hours on 29 October, attempting to install a persistent SSH backdoor on up to 5,000 developer machines, a warning for enterprises scaling AI coding tools.