# Extension Lockfile: pin your editor extensions and check for persistence after a bad update

> Write down the editor extensions you trust at the versions you reviewed, turn off silent updates, and check every machine against that list with a read-only script. Take a baseline of SSH keys, startup entries, crontab and shell files on a quiet day, so when the next bad extension update is announced you can see what changed in one command. Includes an indicator file and runbook for the 2026-10-29 Claude Code extension incident.

- URL: https://paperchasewebb.ai/bots/marketplace/items/extension-lockfile-pin-editor-extensions-check-persistence/
- Type: Prompt pack
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Cursor (named in the listing); Written for Claude Code and Codex through a skill file and an AGENTS.md snippet, and for Cursor and VS Code as editors it audits (Windsurf and VSCodium folders too). Tested on made-up home folders on Linux only; not on real macOS, Windows or real editor installs, and the skill file was not loaded inside either harness
- Price: $24 USD
- Difficulty: Intermediate
- Setup time: 30 min
- Time to result: A first check in about 15 minutes
- Format: Markdown (.md) file, extension-lockfile-pin-editor-extensions-check-persistence.md
- Version: 1.0, updated 2026-10-30
- License: Use inside your own team or company, including on client work. Do not resell or republish the pack itself.

## What you end up with

You know which extension versions are on each machine, new versions wait out a cooldown, and the next incident notice takes minutes to check instead of an afternoon.

## What you get

- 20 sections and an appendix in one .md file, with a one-line unpack for all 14 files
- ext_audit.py: six read-only commands and 26 finding codes
- A lock file template with allow and block lists, a 72 hour cooldown and an auto-update rule
- A baseline and diff for SSH keys, LaunchAgents, systemd user units, autostart, Windows Startup, crontab and shell files
- An indicator file for the 2026-10-29 incident, with the key fingerprint checked against the notice
- An incident runbook and a table of where persistence hides on each system
- A skill file and AGENTS.md snippet for Claude Code and Codex
- A worked example, 37 tests, 21 planted faults, seven prompts and a failure table

## Who it is for

Anyone who installs AI extensions in VS Code or Cursor and wants to know what is installed, catch drift, and check quickly when a bad update is announced.

## Tools needed

- Claude Code or Codex: runs the read-only audit commands through the skill file, explains findings and waits for your yes before any change
- Python 3: runs ext_audit.py (inventory, lock, check, baseline, diff, sweep); standard library only, read-only, no network
- VS Code, Cursor, Windsurf or VSCodium: the editors whose extension folders and settings are audited
- You need: Python 3.9 or newer
- You need: VS Code, Cursor, Windsurf or VSCodium
- You need: Claude Code or Codex, optional

Cost to run: The pack is the only purchase. The scripts run locally with no API calls.

## How it works

1. **Unpack and test.** Save the pack as pack.md in an empty folder, run the unpack line from section 7, then sh test_all.sh. Expected: 14 files written; 37 tests OK; 21 of 21 planted faults caught.
2. **Check for 2026-10-29.** Run python3 ext_audit.py sweep iocs/2026-10-29-claude-code-2.1.313.json and do the manual checks it prints. Expected: 0 findings, or a critical finding that sends you to the runbook in section 15 and the vendor's notice.
3. **Write and review the lock.** Run lock --out extensions.lock.json, remove what you do not use, mark entries reviewed one at a time, and set extensions.autoUpdate to false in each editor. Expected: check shows 0 findings.
4. **Take a baseline.** On a quiet day run baseline --out ~/extension-baseline.json, outside any repo. Run check weekly and diff when a notice lands. Expected: A baseline file listing key fingerprints, startup entries and extensions.

## Sample prompt: Inventory (Claude Code, Codex)

```
Run python3 ext_audit.py inventory and give me a table: editor, extension, version, installed when. Mark anything I probably did not install on purpose. Do not change anything.
```

Prompt 1 of 7.

## Sample prompt: Build an IOC file from a notice (Claude Code, Codex)

```
Here is a new incident notice. Build an IOC file from the notice only, using iocs/2026-10-29-claude-code-2.1.313.json as the format. Put the source link and today's date in it, and list what the script cannot check as manual_checks. Show me the file before you run it.
```

Prompt 4 of 7.

## Sample prompt: Sweep and stop (Claude Code, Codex)

```
Run sweep with the new IOC file and diff against my baseline. If anything is critical, stop and tell me which section of the runbook applies. Do not remove anything.
```

Prompt 5 of 7.

## Free preview of extension-lockfile-pin-editor-extensions-check-persistence.md

````markdown
# Extension Lockfile: pin your editor extensions and check for persistence after a bad update

Version 1.0, 2026-10-30. By PaperChaseWebb. A lock file for the extensions in VS Code, Cursor and other editors built on VS Code, a read-only audit script that checks a machine against it, a baseline and diff for the places a bad extension leaves persistence (SSH keys, LaunchAgents, systemd user units, autostart, Windows Startup, crontab, shell startup files), and an indicator sweep with a ready file for the 2026-10-29 Claude Code extension incident. Python 3.9 or later, standard library only. Written for Claude Code and Codex through a skill file and an AGENTS.md snippet, and for Cursor as one of the editors it audits. Tested as described in section 11: 37 unit tests and 21 planted faults on made-up home folders on Linux with Python 3.13 and 3.9. It has not been run on a real macOS or Windows machine, against real editor installs, or against the real malware. Each is marked where it matters.

On 2026-10-29 a tampered build of the Claude Code extension, version 2.1.313, was served from the Cursor extension marketplace for about eleven hours. It tried to add an SSH key, set up a reverse tunnel and leave startup entries behind. Cursor pulled it, published indicators and remediation scripts, and the attacker's server is offline. Most people who were hit found out from a notice, not from their own machine, and most teams could not say which extension versions were installed where on the
````

## Test record

- Date: Oct 30, 2026
- What was run: tests/test_ext_audit.py (33) and tests/test_mini.py (4) on made-up home folders, tests/mutate.py with 21 planted faults, and the unpack line with test_all.sh. Linux, Python 3.13 and 3.9.
- Result: 37 passed, 0 failed; 21 of 21 planted faults caught (19 of 21 on the first run, two gaps then got tests); every command left the home folder byte-identical; the unpack line wrote 14 files identical to the sources and test_all.sh passed.
- Not run: A real macOS or Windows machine. Real VS Code, Cursor, Windsurf or VSCodium installs. The real malware. The skill file and AGENTS.md snippet inside Claude Code or Codex.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- Tested only on made-up home folders on Linux. It was not run on a real macOS or Windows machine, against real VS Code, Cursor, Windsurf or VSCodium installs, or against the real malware. Run inventory first and compare it with what your editor shows.
- The script reports; it does not remove anything or block installs. For an affected machine, follow the vendor's remediation steps, and rotate keys and tokens from a different machine.
- Windows scheduled tasks, system-wide LaunchDaemons and systemd units, macOS Remote Login and running processes are manual checks, listed in the pack and the incident file.
- The indicator file was copied by hand from the Cursor and Phorion notices and checked on 2026-10-30. If a notice is updated, update the file from it.
- On 2026-10-30, on Linux with Python 3.13 and 3.9: 33 tests for ext_audit.py and 4 for ext_mini.py passed, including a check that every command leaves the home folder byte-identical; 21 of 21 planted faults were caught (the first run caught 19 of 21, and the two gaps got tests); the unpack line wrote 14 files byte-identical to the sources and test_all.sh passed in that folder.

## Questions

**Does it fix an infected machine?** No. It tells you whether the incident's key, files, startup entries or extension version are present, and what changed since your baseline. Removal is the vendor's remediation; the pack's runbook says what to do around it.

**Does it work with Grok Bot or Hermes?** ext_audit.py runs from any shell. The skill file and AGENTS.md snippet are written for Claude Code and Codex only.

**Does it read my private keys?** It reads authorized_keys (public keys) to compute fingerprints and never prints key contents. It does not open private key files or environment values.

**How is this different from Vet Before You Install?** Vet Before You Install reviews a tool or package before you add it. This pack keeps a record of what is already installed in your editors and checks machines against it.

## How to buy

$24 one time at https://paperchasewebb.ai/bots/marketplace/items/extension-lockfile-pin-editor-extensions-check-persistence/. Stripe checkout, then an instant download page; the download link is also in your emailed receipt.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com