Cursor says a malicious Claude Code 2.1.313 extension in its marketplace tried to plant an SSH backdoor

The build, not made by Anthropic, was listed for about 11 hours on 29 October and reached at most 5,000 users; Cursor says uninstalling may not be enough and urges credential rotation.