A backdoor in the Claude Code extension, and the window that does not matter anymore
Fake builds of Anthropic's Claude Code extension sat on Cursor's marketplace for about 11 hours on October 29, reaching at most 5,000 users. What the payload did, the bugs that blunted it, and why one infected Mac kept beaconing 8 hours after the window closed.