Security research group
Appears in 1 story
Analyzed the injected loader
For roughly 11 hours on October 29, 2026, the Claude Code extension listed on Cursor's marketplace was not Anthropic's code. Version 2.1.313 carried a 66-line loader inserted ahead of the legitimate extension, and it tried to open a remote backdoor on the machines of developers who installed or auto-updated it.
Updated 1 hour ago
No stories match your search
Try a different keyword
How would you like to describe your experience with the app today?
