version 2.1.313 of the `anthropic.claude-code` extension in the Cursor Marketplace carried a 66-line loader prepended to the real bundle: on load, before any Claude conversation starts, it adds an attacker key (comment `svc-telemetry`) to `~/.ssh/authorized_keys`, tries to enable SSH, opens a reverse tunnel to 134.209.82.225, and installs persistence (LaunchAgent on macOS, cron on Linux, scheduled task on Windows). Cursor confirmed its marketplace was the origin of the compromise; the npm package, the Open VSX listing, and Microsoft's VS Code extension are reported NOT malicious. Anyone who ran that build should treat the host as compromised and rotate credentials from a clean machine. (Two reports of the same incident, grouped as one entry.)
Caveat — Two reports of the same incident, grouped as one entry.