tl;dr: Phorion found a backdoor in versions 2.1.312 and 2.1.313 of the Claude Code for VS Code extension distributed via the Cursor Marketplace, which plants an attacker SSH key in `authorized_keys`, attempts to enable SSH, and establishes a reverse SSH tunnel to 134.209.82.225 with platform-specific persistence (LaunchAgent, cron, or scheduled task). A bug in the macOS logic causes the SSH-enable step to silently skip when run as a non-admin user, but keys, persistence, and a host-recon beacon still deploy. Cursor has pulled the versions; uninstalling alone doesn't remediate—keys, tunnels, and persistence artifacts must be manually removed.