VS Code extension host planting svc-telemetry SSH key in authorized_keys
Detects a VS Code-family editor or extension host modifying ~/.ssh/authorized_keys, or shell commands appending the svc-telemetry label / embedded Ed25519 key, as used by the trojanized anthropic.claude-code extension.
Microsoft Sentinel (KQL)
