The Hacker News reports that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update. According to the report, the malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity. The report says it attempted to install a persistent SSH backdoor on affected systems.
The report says Cursor temporarily shut down access to the extension in response. The source excerpt is cut off at that point, so the report does not provide further details on the scope of affected users, the attackers, or the remediation steps.