A tampered Claude Code extension was listed in Cursor’s VS Code marketplace for about eleven hours on Thursday, affecting up to 5,000 users; Anthropic did not build it. It attempted to collect hostname, username, operating system, and public IP and to set up remote access, which Cursor says typicall