Security firm Phorion discovered a backdoor in the official Claude Code for VS Code extension version 2.1.313 distributed via the Cursor Marketplace, which installs a persistent SSH backdoor across macOS, Linux, and Windows. The compromised extension.js bundle contains a prepended IIFE that executes immediately upon Node.js load, before the extension activates. Stage 1 appends an attacker-controlled Ed25519 public key (comment "svc-telemetry", fingerprint SHA256:0Z6R+DF64Do2nwQic8a7kkfDLNNk4IiK+2U2Rci4htk) to ~/.ssh/authorized_keys with permissions 0700/0600. It then attempts to enable the local SSH daemon: on macOS it runs `systemsetup -getremotelogin` without privileges, which prints an admin error and exits 0; the script misinterprets this output as "SSH not Off" and skips the `sudo -n systemsetup -setremotelogin on` enablement, breaking inbound access unless Remote Login was already enabled. Linux uses systemctl/service fallbacks; Windows attempts OpenSSH installation via PowerShell but passes commands to a helper hardcoded to `/bin/sh`. Stage 2 establishes a reverse SSH tunnel to 134.209.82.225:22 as user "tunnel" using an embedded private key ("svc-telemetry-tun", fingerprint SHA256:KOAU57+ZG6u3MG4WwzPzPX2O5YEe9qdOC1Bl+6MVyDQ) written to `/tmp/.stk_ `, forwarding `-R *:0:localhost:22` via `autossh` or `ssh` with keepalives and a 60-second retry loop. Stage 3 installs persistence: macOS writes `~/.config/.smt` (script with embedded key) and `~/.config/.smtk`, plus a user LaunchAgent `~/Library/LaunchAgents/com.apple.sysmond.plist` (RunAtLoad, KeepAlive) loaded via `launchctl`; Linux adds an `@reboot` cron entry for `~/.config/.smt` (bug may wipe existing crontab); Windows attempts a SYSTEM scheduled task "SysMon" with a Startup folder fallback. Stage 4 beacons host reconnaissance (hostname, user, OS, Git email, public IP via ifconfig.me/ipify.org, and up to 40 env var names matching KEY|TOKEN|SECRET|PASS|AWS|GCP) via HTTP POST to 134.209.82.225:8099/beacon and 127.0.0.1:8099/beacon. Indicators include SHA-256 ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 for the backdoored bundle. Remediation requires killing tunnel processes, removing persistence artifacts, deleting planted keys from authorized_keys and tmp, verifying SSH state, and rotating credentials.