Trojanized Claude Code extension on Open VSX planted SSH backdoor, forced Cursor Marketplace offline

The official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected hosts¹. The issue was traced to a compromise of the Cursor Marketplace, prompting Anysphere's Cursor to briefly take down the service to remove the malware. Two serious security issues hit Cursor on the same day². The incident follows Vector Wire's October 30 coverage of EMBRACE flaws affecting five AI coding tools^[2].