Was reading about the malicious Claude code extension that show up in Cusor marketplace. The pary that got me was it trying to add an SSH key and open a reverse tunnel l, from something that just look like another editor extension

We talk a lot abt checking npm package and dependencies, but IDE extension feal like one of those thing people install once and forget abt it. Especially with auto updates enbled

Those things make me wonder how much access we are giving these extension without really thinking abt it. Are people actually restricting extension on work machines or is it mostly up to each dev? Curious if anyone team changed anything after this 🤔

Source:https://cursor.com/blog/claude-code-extension-security-notic