Cursor's marketplace served a tampered Claude Code extension with a backdoor

TL;DR

• A tampered Claude Code extension, versions 2.1.312 and 2.1.313, sat in Cursor's marketplace for about 11 hours on 29 October and tried to plant an SSH backdoor.
• Wired reports Cursor's figure as at most 5,000 users. Anthropic says its systems weren't compromised, and Microsoft says Anthropic confirmed that to it.
• If you took either version, run Cursor's check, because uninstalling may not remove what the extension left behind.