Malicious Claude Code extension exposed up to 5,000 Cursor users to backdoor malware

BleepingComputer reports that a malicious Claude Code extension was available on Cursor's marketplace for about 11 hours on October 29, exposing up to 5,000 developers to malware designed to install a persistent SSH backdoor. Cursor removed the extension and says it found no evidence other versions were affected. Researchers cited by BleepingComputer say coding errors likely prevented remote access on many affected systems. Users who downloaded it should check for an 'svc-telemetry' SSH key.