reporting on the Cursor Marketplace compromise continued to top Hacker News today (a 655-point post titled "Backdoors in official Claude Code extensions" and a 399-point DoublePulsar analysis), and the new concrete piece is Cursor's own security notice confirming a malicious Claude Code extension was found in its marketplace. The underlying incident — a trojanized extension planting an SSH backdoor — is the one covered in yesterday's digest; anyone who ran that build should already be treating the host as compromised. (Three reports of the same incident, grouped as one entry.)
Caveat — Three reports of the same incident, grouped as one entry.