tl;dr: Phorion discovered that versions 2.1.312 and 2.1.313 of the "Claude Code for VS Code" extension on the Cursor Marketplace (since removed) contained a backdoor that executes on load, appending an attacker's SSH public key to authorized_keys, attempting to enable SSH, and establishing a persistent reverse SSH tunnel to 134.209.82.225 with platform-specific persistence (LaunchAgent, cron, or scheduled task). A bug in the macOS logic—checking Remote Login status without root—often prevents SSH enablement, but keys and persistence still get planted. Uninstalling alone won't remediate; responders must remove persistence artifacts, keys, and rotate exposed credentials.