Extension Lockfile: pin your editor extensions and check for persistence after a bad update
by PaperChaseWebb
Write down the editor extensions you trust at the versions you reviewed, turn off silent updates, and check every machine against that list with a read-only script. Take a baseline of SSH keys, startup entries, crontab and shell files on a quiet day, so when the next bad extension update is announced you can see what changed in one command. Includes an indicator file and runbook for the 2026-10-29 Claude Code extension incident.
- Price
- $24
- Difficulty
- Intermediate
- Setup
- 30 min
- Format
- .md file
extension-lockfile-pin-editor-extensions-check-persistence.md · 85 KB · instant download after checkout
Want this built for you instead? We can build it for you.
What you end up with
You know which extension versions are on each machine, new versions wait out a cooldown, and the next incident notice takes minutes to check instead of an afternoon.
What you get
- 20 sections and an appendix in one .md file, with a one-line unpack for all 14 files
- ext_audit.py: six read-only commands and 26 finding codes
- A lock file template with allow and block lists, a 72 hour cooldown and an auto-update rule
- A baseline and diff for SSH keys, LaunchAgents, systemd user units, autostart, Windows Startup, crontab and shell files
- An indicator file for the 2026-10-29 incident, with the key fingerprint checked against the notice
- An incident runbook and a table of where persistence hides on each system
- A skill file and AGENTS.md snippet for Claude Code and Codex
- A worked example, 37 tests, 21 planted faults, seven prompts and a failure table
Who it is for
Anyone who installs AI extensions in VS Code or Cursor and wants to know what is installed, catch drift, and check quickly when a bad update is announced.
Works with
Solid chips: the agent is named in this listing's own tools list. Dashed chip: Written for Claude Code and Codex through a skill file and an AGENTS.md snippet, and for Cursor and VS Code as editors it audits (Windsurf and VSCodium folders too). Tested on made-up home folders on Linux only; not on real macOS, Windows or real editor installs, and the skill file was not loaded inside either harness.
Tools needed
Cost to run: The pack is the only purchase. The scripts run locally with no API calls.
Time to result: A first check in about 15 minutes
How it works
Unpack and test
Save the pack as pack.md in an empty folder, run the unpack line from section 7, then sh test_all.sh.
Expected: 14 files written; 37 tests OK; 21 of 21 planted faults caught.
Check for 2026-10-29
Run python3 ext_audit.py sweep iocs/2026-10-29-claude-code-2.1.313.json and do the manual checks it prints.
Expected: 0 findings, or a critical finding that sends you to the runbook in section 15 and the vendor's notice.
Write and review the lock
Run lock --out extensions.lock.json, remove what you do not use, mark entries reviewed one at a time, and set extensions.autoUpdate to false in each editor.
Expected: check shows 0 findings.
Take a baseline
On a quiet day run baseline --out ~/extension-baseline.json, outside any repo. Run check weekly and diff when a notice lands.
Expected: A baseline file listing key fingerprints, startup entries and extensions.
Sample prompts, free to use
Run python3 ext_audit.py inventory and give me a table: editor, extension, version, installed when. Mark anything I probably did not install on purpose. Do not change anything.
Prompt 1 of 7.
Here is a new incident notice. Build an IOC file from the notice only, using iocs/2026-10-29-claude-code-2.1.313.json as the format. Put the source link and today's date in it, and list what the script cannot check as manual_checks. Show me the file before you run it.
Prompt 4 of 7.
Run sweep with the new IOC file and diff against my baseline. If anything is critical, stop and tell me which section of the runbook applies. Do not remove anything.
Prompt 5 of 7.
Free preview of the file
# Extension Lockfile: pin your editor extensions and check for persistence after a bad update Version 1.0, 2026-10-30. By PaperChaseWebb. A lock file for the extensions in VS Code, Cursor and other editors built on VS Code, a read-only audit script that checks a machine against it, a baseline and diff for the places a bad extension leaves persistence (SSH keys, LaunchAgents, systemd user units, autostart, Windows Startup, crontab, shell startup files), and an indicator sweep with a ready file for the 2026-10-29 Claude Code extension incident. Python 3.9 or later, standard library only. Written for Claude Code and Codex through a skill file and an AGENTS.md snippet, and for Cursor as one of the editors it audits. Tested as described in section 11: 37 unit tests and 21 planted faults on made-up home folders on Linux with Python 3.13 and 3.9. It has not been run on a real macOS or Windows machine, against real editor installs, or against the real malware. Each is marked where it matters. On 2026-10-29 a tampered build of the Claude Code extension, version 2.1.313, was served from the Cursor extension marketplace for about eleven hours. It tried to add an SSH key, set up a reverse tunnel and leave startup entries behind. Cursor pulled it, published indicators and remediation scripts, and the attacker's server is offline. Most people who were hit found out from a notice, not from their own machine, and most teams could not say which extension versions were installed where on the
Test record
- Date
- Oct 30, 2026
- What was run
- tests/test_ext_audit.py (33) and tests/test_mini.py (4) on made-up home folders, tests/mutate.py with 21 planted faults, and the unpack line with test_all.sh. Linux, Python 3.13 and 3.9.
- Result
- 37 passed, 0 failed; 21 of 21 planted faults caught (19 of 21 on the first run, two gaps then got tests); every command left the home folder byte-identical; the unpack line wrote 14 files identical to the sources and test_all.sh passed.
- Not run
- A real macOS or Windows machine. Real VS Code, Cursor, Windsurf or VSCodium installs. The real malware. The skill file and AGENTS.md snippet inside Claude Code or Codex.
Copied from this item's dated test notes. What was not run stays in.
Worth knowing
- Tested only on made-up home folders on Linux. It was not run on a real macOS or Windows machine, against real VS Code, Cursor, Windsurf or VSCodium installs, or against the real malware. Run inventory first and compare it with what your editor shows.
- The script reports; it does not remove anything or block installs. For an affected machine, follow the vendor's remediation steps, and rotate keys and tokens from a different machine.
- Windows scheduled tasks, system-wide LaunchDaemons and systemd units, macOS Remote Login and running processes are manual checks, listed in the pack and the incident file.
- The indicator file was copied by hand from the Cursor and Phorion notices and checked on 2026-10-30. If a notice is updated, update the file from it.
- On 2026-10-30, on Linux with Python 3.13 and 3.9: 33 tests for ext_audit.py and 4 for ext_mini.py passed, including a check that every command leaves the home folder byte-identical; 21 of 21 planted faults were caught (the first run caught 19 of 21, and the two gaps got tests); the unpack line wrote 14 files byte-identical to the sources and test_all.sh passed in that folder.
Questions
Does it fix an infected machine?
No. It tells you whether the incident's key, files, startup entries or extension version are present, and what changed since your baseline. Removal is the vendor's remediation; the pack's runbook says what to do around it.
Does it work with Grok Bot or Hermes?
ext_audit.py runs from any shell. The skill file and AGENTS.md snippet are written for Claude Code and Codex only.
Does it read my private keys?
It reads authorized_keys (public keys) to compute fingerprints and never prints key contents. It does not open private key files or environment values.
How is this different from Vet Before You Install?
Vet Before You Install reviews a tool or package before you add it. This pack keeps a record of what is already installed in your editors and checks machines against it.
Details
Version 1.0 · Updated Oct 30, 2026 · Markdown version of this page
License: Use inside your own team or company, including on client work. Do not resell or republish the pack itself. Download terms
Related
Extension Lockfile: an allow-list check for your editor extensions (free sample)
From Extension Lockfile: the quick checks for the 2026-10-29 Claude Code extension incident, pointing to the vendor's notice, five habits for editor extensions, and a read-only script that flags extensions not on your allow list, at an unapproved version, or installed in the last few days.
Vet Before You Install: twelve checks, a sandbox recipe and a tested vetting folder for third-party agent code
Decide whether a skill, plugin, mod, MCP server, connector, repo or model gets into your agent setup: sort the seat, read every file that runs, map reach and the data path, pin and vendor it, trial it in a sandbox with a planted fake key, then record a decision the owner approves at their own terminal. v1.1 adds a seat sort before any vetting, two new checks (data path and reach, approval surfaces), evidence tiers, twelve token classes including hidden text, encoded strings, startup file edits and approval hooks, a fresh-session second read, data path questions for proxies and routers, dependency and model weight pinning, a fifth decision (not vettable) with recheck dates and an approved shelf, more special cases, a vetting folder with a fifteen-check read-only checker and an owner approval helper, agent files for Grok Bot, Claude Code, Codex and Hermes, and twelve new prompts (27 in all). Price unchanged.
Shrink the Attack Surface: patch with proof, then attack your own agent's tools
Your agent lists everything your app exposes, read-only: routes, open ports, public buckets, secrets in the repo, unused dependencies, debug endpoints, admin paths, CORS, API key scopes and its own tool permissions. You decide keep, remove or lock for each. Every fix gets a proof that fails before the change and passes after it, and the proof stays as a regression test. Then attack drills run against your agent's own tool gate, offline: pressure, impersonation, injected tool output, stale and non-owner approvals and a failing tool. Each is judged by what the tools actually did, and every drill that gets through becomes a test that fails before the fix and passes after. A failing tool stops at a retry budget and asks you, and every approval is yours, typed at your own terminal and tied to a sha256.
Release Watch: a per-change monitoring plan your agent writes from the diff, run by a fixed script
After a change goes live, your agent reads the diff and writes a small watch plan for that change: which signals it could move, against which baseline, by how much, for how long. A fixed script runs the plan every five minutes, so no agent sits in a loop. On a trip, a second agent triages read-only and proposes one next step. Rollbacks, flag flips and alert changes stay with you.
Pre-launch security prompts for vibe-coded apps: Supabase RLS, leaked keys and open doors, with two checks you can run yourself
14 prompts that make your coding agent find exposed keys, tables without row level security, open buckets and unverified webhooks in your own app, then fix them one commit at a time. Version 1.1 adds two read-only checks you run yourself: rls_check.sql, which logs in as the public key and as a second user to prove a stranger cannot read your rows, and bundle_scan.py, which finds secret keys in your production build, including a service role key grep cannot see. Both were tested on a made-up app with planted problems.
AGENTS.md, CLAUDE.md and Cursor rules starter files
Six fill-in instruction files for coding agents (base, Next.js plus Supabase, FastAPI, browser game, CLAUDE.md pointer, scoped Cursor rules), an Approvals section that makes the agent stop and wait for your yes, a table of what Grok Bot, Claude Code, Codex, Hermes and Cursor each read, a read-only checker for your rule files and 9 prompts to write, trim and test your own.
Check your machine for the backdoored Claude Code editor extension and clean up properly
For about eleven hours on Oct 29, Cursor's extension marketplace served a tampered build of the Claude Code extension (2.1.313) to up to 5,000 users. It added an SSH key and startup persistence that survive uninstalling the extension, so the fix is a check, an update and a credential rotation, not just a reinstall.
Bug Report Your Agent Can Fix
A no-install way to turn "it is broken" into a report a coding agent can act on: a capture checklist, one report template, a redaction step for logs, a read-only checker, and four prompts that make the agent reproduce, fix, test and write back what changed.