- 2nd November 2026
Tampered builds of the Claude Code extension, versions 2.1.312 and 2.1.313, sat in the Cursor marketplace for 11 hours and reached up to 5,000 developers. They plant an attacker SSH key, open a reverse tunnel, and survive uninstall. No CVE exists, so CVE-driven scanners will never flag them.
Daniel Reeves


















