Editor extensions deserve the same rules you already apply to CI dependencies. A trojanized Claude Code extension shipped through the Cursor Marketplace as a legitimate update and tried to plant a persistent SSH backdoor, per The Hacker News. SecurityWeek reports PHP2Shell rooting Palo Alto firewalls while failing on WordPress, and WordPress 7.1.4 fixes 22 vulnerabilities.
We inventory installed extensions, pin versions and audit dev machines for leftover keys. Ask us for that review.