Official Claude Code VS Code Extension Compromised to Install Persistent SSH Backdoor

What this means for you — Security leader:Audit all VS Code extensions from third-party registries such as Open VSX or Cursor Marketplace. Scan developer endpoints for the indicators in Microsoft's analysis and rotate any SSH keys that may have been exposed.

What this means for you — Lean IT orgs:Check every VS Code install for the malicious Claude Code version 2.1.313 and remove it. If you use Cursor, treat every developer machine as potentially compromised and change SSH keys.

What this means for you — MSP:Inventory client VS Code extensions from non-Microsoft registries; look for the tampered Claude Code package and the SSH backdoor artifacts documented by Microsoft. Advise immediate key rotation where found.

What this means for you — Researcher:Review the supply-chain compromise via Cursor Marketplace and the persistent SSH backdoor implementation; cross-reference Microsoft's technical breakdown with Phorion's findings.