Claude Code Extension Persistence Installation

Ravi Asakapalli@Ravishankaraskp

•updated yesterday•4•0•13

Detects persistence mechanisms installed by the trojanized Claude Code extension: macOS LaunchAgent plists, Windows scheduled tasks or Startup scripts, and Event ID 4698 scheduled task creation, when created by Node.js, Electron, Cursor, or VS Code processes