Trojanized Claude Code extension on Cursor's marketplace carried a persistent SSH backdoor

The malicious builds sat in the extension marketplace that Cursor operates, and Cursor says Anthropic did not write them. The payload collected hostname, username, OS and public IP, then tried to add an attacker-controlled SSH key, enable local SSH and open a reverse tunnel. Persistence came through a LaunchAgent on macOS or a scheduled task on Windows, retrying about every 60 seconds. Cursor pulled the version, briefly shut the marketplace, rotated its keys and had the attacker server taken offline. Cursor notes that the SSH step would likely fail on most machines without admin rights, yet it still tells users to remove unauthorized keys, persistence scripts and tunnel processes wherever the affected versions ran. Uninstalling the extension may not be enough because the payload drops standalone scripts. Cursor reports no sign that other extensions or the official distribution were touched. For teams building on coding agents, this is a supply chain problem: an extension that looks official can run code with a developer's full privileges. Check publisher and version against known-good builds, pin extensions, and audit anything that installs background processes before it reaches a workstation.