Posted by _chall 1 day ago
I've started developing with a separate user account to limit the blast radius but you still need to login to access repos and use AI features.
As if this wasn't coordinated by a team directed by the government of North Korea.
Claude Code was already malware, but with this attack you cannot trust the vendor either.
In the next 2 weeks, no one should download / install / update anything as I predict at least one developer's key for a GitHub, NPM, Crates.io or any other CI or login was leaked and the attacker will target those services to propagate their trojan to more victims.
strongly suggest put your valuable work on local llm.
The amount of problems it's had from compromised extensions is ridiculous.