Tampered Claude Code extension plants SSH keys
Identify affected Cursor packages by channel and bytes, then distinguish attempted SSH access from the independent host changes that remain after extension removal.
Replay2:56 Narrated visual walkthrough
Follow the loader’s host changes
Check execution and local SSH availability
Contain the host and written artifacts
