Phorion detected a backdoor in the official Claude Code for VS Code extension bundle on the Cursor Marketplace that installs a persistent SSH backdoor on macOS, Linux, and Windows. The finding affects users who obtained the extension through that marketplace.