Malicious Claude Code Extension on Cursor's Marketplace Planted an SSH Backdoor: How to Check and Clean Up
Tampered Claude Code 2.1.312 and 2.1.313 builds on Cursor's marketplace tried to plant an SSH backdoor on Oct 29. How to check for svc-telemetry and clean up.
MCSA Guru Team Nov 1, 2026 9 min read