How Can 66 Lines of JavaScript Turn a Claude Code Plugin into an SSH Backdoor? All 6 Attack Stages Explained
Author’s note: This article breaks down the malicious Claude Code extension found in Cursor’s extension marketplace. It explains how the 66-line loader is triggered, how two sets of SSH keys work with a reverse tunnel, which findings are confirmed and unconfirmed, and how developers can investigate. On October 29, 2026, a compromised anthropic.claude-code extension appeared…