Tampered Claude Code Hit Up to 5,000 Cursor Users

For about 11 hours on October 29, a tampered copy of Anthropic's Claude Code extension sat in Cursor's VS Code extension marketplace, under the real name. Cursor says at most 5,000 users were affected. The hidden code tried to add an attacker's SSH key, open a tunnel to the attacker's server and set up a startup job. Cursor says that on most Mac and Windows machines the attacker could not have logged in through the tunnel, but that the key, the startup job and the details sent happened either way.