Claude Code
Extension backdoor found
Backdoor found in Claude Code VS Code extension on Cursor Marketplace
Phorion found a persistent SSH backdoor in versions 2.1.312 and 2.1.313 of the official Claude Code VS Code extension on the Cursor Marketplace. Cursor has removed both versions. Developers and teams who installed the extension should check their machines now, since the payload runs as soon as the extension loads.