Up to 5,000 Users Downloaded Backdoored Extension From Cursor Marketplace. Attackers backdoored the official Claude Code VS Code extension, being distributed on the Cursor Marketplace, designed to give attackers persistent SSH access to any endpoint on which the extension was installed. Cursor said about 5,000 users downloaded the malicious extension.
First seen on govinfosecurity.com
Jump to article: www.govinfosecurity.com/cursor-confirms-anthropic-claude-code-extension-compromised-a-33263
