AI
Cursor pulls its extension marketplace after a trojanized Claude Code update planted SSH backdoors
Cursor shut its VS Code extension marketplace after a tampered build of Anthropic's official Claude Code extension, served as version 2.1.313 under the real publisher identity, was offered for about 11 hours on 29 October. A 66-line loader added an attacker-controlled SSH key labelled svc-telemetry to authorized_keys, tried to open a reverse tunnel, installed persistence as a scheduled task, crontab or LaunchAgent and beaconed host details over plain HTTP. Cursor puts exposure at no more than 5,000 users.
Sources
Cursor (security notice)The Hacker NewsMicrosoft Threat Intelligence