Editor extension host runs git config --global user.email then curl IP lookup

Arnold Chan@slaz

•updated today•20•0•27

Detects a VS Code-family editor or extension host process running 'git config --global user.email' and, within one minute from the same parent process, a curl public-IP lookup (ifconfig.me / api.ipify.org), the host-profiling step of the trojanized anthropic.claude-code loader.