The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Auto-updating editor extensions is the riskiest setting on a dev laptop.
The backdoored Claude Code extension on Cursor's marketplace, versions 2.1.312 and 2.1.313, ran the moment the editor loaded it. No click, no prompt. It added an SSH key to authorized_keys, opened a tunnel out, and reported the names of any environment variables that looked like keys or tokens. Anthropic's staff say those versions never went out through its own channels.
Most of the Hacker News thread asks for signed extensions. Signing would help, but it proves who signed the file, not that the right person did. It also does nothing once a bad version lands on every machine overnight.
The Claude Code plugins I run come from a repo I own, and an install only changes when I run the update myself. That's slower, and it means a bad push can't reach my laptop until I choose to take it.
Some in the thread wait a week before taking any extension update. How long do you wait?
Source: https://phorion.io/blog/offical-claude-code-vsx-compromise
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
Friday Question: When Did You Last Check Your Website on Your Phone? 📱
Not on your laptop.
Not in the editor preview.
On your actual phone. The way your customers see it.
This week I did exactly that with my own website. And I didn’t love what I saw.
The menu button was plain. The dropdown felt like an afterthought. And the most important button, “Let’s Talk,” was just another line of text in a list.
So I rebuilt it.
✔ A clearer menu button
✔ A proper slide-out menu
✔ A call-to-action you can’t miss
Nothing was “broken.” It just wasn’t helping anyone take the next step.
Here’s a 60-second test you can do right now:
→ Open your website on your phone
→ Tap the menu
→ Try to contact yourself
How many taps did it take? Did anything feel awkward?
Friday question: when did you last check your website on your phone? And what did you notice? 👇
I Found 70 Spam Comments on My Own Website This Morning 😅
Yes. Mine.
I build and fix websites for a living. And this morning I opened my own dashboard to find:
❌ 70 comments waiting for approval, almost all of them betting sites, adult links and “great post, admin!” bots.
❌ 16 plugins sitting there with updates waiting.
❌ Contact forms with zero spam protection.
Nothing was “broken.” The site still loaded. Still looked fine.
That’s exactly the problem.
Most website problems don’t announce themselves. They build up quietly in the background while you’re busy running your business.
Outdated plugins become security gaps.
Spam comments make a site look abandoned.
Unprotected forms flood your inbox until you stop checking it, and miss the one real enquiry that mattered.
So here’s what I did:
✔ Updated every plugin (with backups first)
✔ Added a spam filter for comments
✔ Added hidden spam protection to every form
✔ Cleared out the 70 spam comments
Less than an hour. But only because I actually looked.
A website isn’t something you launch and forget.
It’s more like a car. It runs fine… until the day it doesn’t.
Quick question: When was the last time you logged into your website’s dashboard? 👇
If the honest answer is “I don’t remember,” send me a message. I’ll take a look.
Haha the irony is real Victor! I build and fix websites for a living and then your own dashboard has 70 spam comments waiting 😅 Those "great post, admin!" bots and betting sites are relentless. Nothing looked broken, that was exactly the problem - so relatable! Love how you turned it into a content piece too.
waitlist animated block, just one single command to install on your own project via cli.
Nice