Your editor extensions have production access now
ยท 5 min read
On 30 October, Phorion published an advisory about the official Claude Code for VS Code extension on the Cursor Marketplace. Versions 2.1.312 and 2.1.313 carried a prepended payload that ran the moment Node loaded the file. Cursor has pulled both versions. If you're a small team, the uncomfortable part is that the laptop running that extension is probably also the laptop with your Stripe key, your cloud CLI login, and push access to main.