Your IDE Extension Just Added an SSH Key: Inside the Trojanized Claude Code Extension on Cursor's Marketplace

For about eleven hours on October 29, 2026, anyone using Cursor who installed or auto-updated Anthropic's Claude Code extension from Cursor's extension marketplace could have received a build that tri