"Phorion has detected a backdoor in the official Claude Code for VS Code extension bundle on Open VSX that drops a persistent SSH backdoor across macOS, Linux, and Windows. This write-up focuses primarily on macOS, where the extension attempts to configure an SSH backdoor and establish persistence. Organisations should immediately review their environments for use of Claude Code for VSCode 2.1.313 and engage incident response where use of the extension is discovered." https://phorion.io/blog/offical-claude-code-vsx-compromise/