Cursor's malicious Claude Code extension needs cleanup beyond uninstalling
Cursor identifies a tampered 2.1.313 extension that installed SSH keys and persistence. Its server is offline, but affected machines still need investigation and credential review.