Code you didn't write runs on your signed-in pages. The Hacker News reports ~$2.7M taken from Polymarket traders after a hijacked page-speed script sold their positions. SecurityWeek covers a malicious Claude Code extension served via Cursor that tried a reverse SSH tunnel, plus an unpatched CryptoPayment Gateway plugin flaw that can expose wallet credentials. Inventory external scripts, pin or self-host, keep sessions unable to move value. We review payment and script flows, reply to scope it.
Was this useful?