#VS Code extensions

Tampered Claude Code extension on Cursor's marketplace planted an SSH backdoor

For about 11 hours on October 29, 2026, Cursor's extension marketplace served a modified Claude Code extension that installed an attacker SSH key and persistence.