On October 29, Cursor's extension marketplace served tampered builds of Anthropic's Claude Code extension, versions 2. 1. 312 and 2.
Source: [Dev.to](https://dev.to/dhruv1206/how-a-trusted-extension-name-delivered-an-ssh-backdoor-through-cursors-store-31ba)