Was reading about the malicious Claude code extension that show up in Cusor marketplace. The pary that got me was it trying to add an SSH key and open a reverse tunnel l, from something that just look like another editor extension

We talk a lot abt checking npm package and dependencies, but IDE extension feal like one of those thing people install once and forget abt it. Especially with auto updates enbled

Those things make me wonder how much access we are giving these extension without really thinking abt it. Are people actually restricting extension on work machines or is it mostly up to each dev? Curious if anyone team changed anything after this 🤔

Source:https://cursor.com/blog/claude-code-extension-security-notic

I manage a lot of repos, that are changed by multiple devs and every few months it turns into a mess: hundreds of merged branches nobody deleted, PRs that went quiet a year ago, repos nobody has touched since a project ended. GitHub only lets me deal with it one repo at a time, so mostly I just... don't.

Curious how others handle this:

- Do you run a script (gh CLI, an Action), use a tool, or just ignore it?

- What's the most annoying part?

- What would you never trust a tool to do automatically?

Especially interested in hearing from people managing 30+ repos or a team org.