Cursor says it removed the altered packages and had the attacker’s server taken offline. Phorion found that the code planted an SSH key and persistence mechanisms; uninstalling the extension may leave these behind.
The vendor asks users to check affected machines, isolate hosts showing execution traces, remove malicious access and scripts, and rotate credentials from a trusted device. Remote access depended in part on SSH being enabled; installation therefore does not establish that an attacker logged in.