EVERY SIGNAL, SORTED.

United States, Cursor, Claude Code, Software Supply Chain, Developer Security, Extension Marketplaces, SSH, Persistence, Incident Response, Package Provenance, Checksums, Signatures and AI Coding Tools

A fake Claude extension planted an SSH key. Make every install carry a provenance receipt

Cursor served tampered copies of a Claude Code extension that tried to leave persistent remote access behind. The repair is not another trust badge. It is a receipt that proves exactly which package reached which machine, from which registry, under whose approval.