Claude Code extension poisoned with persistent SSH backdoor

A malicious version (2.1.313) of Anthropic’s Claude Code extension on the Open VSX marketplace contained an injected payload that added an attacker SSH key, opened a persistent outbound SSH tunnel to enable remote interactive access, collected host and environment-variable metadata (including token/key names), and installed cross-platform persistence; up to 5,000 Cursor users may have been affected and responders published cleanup commands and IOCs while taking the attacker server offline.