A maliciously modified Claude Code VS Code extension

A maliciously modified Claude Code VS Code extension, published under Anthropic's own legitimate `anthropic.claude-code` identifier, was distributed through Cursor's marketplace for roughly 11 hours on 2026-10-29 and attempted to plant a persistent SSH backdoor on up to 5,000 developer machines. Cursor shut down its entire marketplace to audit and rotate keys.

`thedotmack/claude-mem`, a persistent cross-session agent-memory tool this research has tracked since October 4, spikes to GitHub Trending #1 with +1,140 stars in a single day — nearly as much growth as its entire prior month combined, after sitting at #8 just yesterday.

GitHub Trending's agent/harness/skill concentration lands its eighth tracked data point on the longest board yet (15 items), reading 70% on the top 10 and 73% on the full board — inside the 57-93% range the metric has held across eight days, with board length itself increasingly correlating with a lower top-10 reading.