https://www.live-feeds.com/feed/cursor-says-up-to-5-000-users-affected-by-tampered-claude-code-extensionContinuously updated, source-cited coverage. https://www.live-feeds.com/feed/cursor-says-up-to-5-000-users-affected-by-tampered-claude-code-extensionhttps://www.live-feeds.com/feed/cursor-says-up-to-5-000-users-affected-by-tampered-claude-code-extension#u181530Fri, 06 Nov 2026 14:26:36 +0000Up to 5,000 users may have installed a maliciously modified version of Anthropic's Claude Code extension on the Cursor VS Code extension marketplace. The compromised software attempted to install a persistent SSH backdoor and harvested sensitive system data such as usernames, hostnames, operating systems, and public IP addresses. Cursor removed the malicious upload from its marketplace and verified that no other extensions were affected. Anthropic confirmed it was not involved in building, publishing, or hosting the tampered extension.Why it mattersSupply chain attacks targeting developer