Phorion analyzes SSH backdoor in Claude Code extension on Cursor Marketplace

Backdoor in Claude Code for VS Code extension on the Cursor Marketplace

Phorion found that the official Claude Code for VS Code 2.1.313 extension on Cursor Marketplace had been implanted with a persistent SSH backdoor, and the affected version has been taken down.

Why it matters: Phorion traces the backdoor's file writes and persistence artifacts, so detection keys on file changes and tunnel behavior rather than an SSH enable command that may be missing.