This is from the Cursor blog [1] linked in the description, but repeating it here in case it's useful to anyone:

------

Check whether you are impacted

The malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:

On macOS, run:

   grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"

On Windows, run in PowerShell:

   $files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
   if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }

------

[1] https://cursor.com/blog/claude-code-extension-security-notic...