Check for IOCs for the ongoing Claude Code extensions exfil campaign

A read-only scanner called check-claude-code-exfil checks macOS, Linux, and Windows hosts for indicators of compromise tied to a documented Claude Code for VS Code extension campaign. It inspects extension versions and bundle hashes, SSH keys and fingerprints, persistence mechanisms, processes, and live TCP connections, without remediating anything or contacting attacker…