Cursor Extension Backdoor

Malicious Claude Code-branded extension versions 2.1.312 and 2.1.313 in Cursor’s marketplace attempted SSH persistence and host reconnaissance; teams should identify affected installs, isolate impacted hosts, remove artifacts, review telemetry, and rotate exposed credentials.