The official Claude Code extension on the Cursor development environment’s marketplace contained an SSH backdoor.