Attack
A modified copy of the Claude Code extension attempted to open SSH access for Cursor users.
The trapped versions 2.1.313 and 2.1.312 were offered for a few hours on the Cursor marketplace.
According to Microsoft, the injected code attempts to add an SSH key, create a reverse tunnel and stay active.
Remote access depends on the rights on the machine and on the SSH configuration of the machine and of the attacking server.
Removing the extension leaves in place the malicious keys and scripts created outside its folder.