Ok, so... Summing this up

- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.

So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)

Apparently it is public: https://cursor.com/help/customization/extensions

They use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.

Ironically, that page has a paragraph "How Cursor reduces supply-chain risk:"

Which is exactly the opposite of what happened today.

well maybe they did reduce supply chain risk, but still need to reduce it some more

> Team admins can defer extension installs and updates until a marketplace version has been published for a minimum number of hours.

I think everyone is going to be setting this to 168 after today.

Yes. Cursor marketplace is a mirror of Open VSX except they inject some plugins that are not in Open VSX for some reason. This works because Open VSX has basically no security. Which was already an issue.

Yeah, their blog post is not very transparent at what happened here. Does not instill trust.

Oh god... this needs more attention

An official announcement from Anthropic would be nice!

I’d expect nothing less than a post mortem on how this happened to be honest.

This has nothing to do with anthropic. One (or two) distribution channels were hacked. The hackers decided to distribute their malware through the claude extension, probably because it's popular.

I’d still expect a post mortem, be it from Cursor or Anthropic.

An honest post mortem will come any day now... Any day post the IPO probably

69k rep here. I treated stackoverflow as my “facebook”. I even have moderator permissions.

I still left eventually and LLM has nothing to do with it. It’s the “closing as duplicate”, it’s the “provide text explanation not just code”, it’s the “deleted as off topic”.

I can’t tell you how many times I was finding useful info in DELETED answers (I see them as moderator). And the existing “vote for undelete/reopen” procedure does not work.

SO did not die because of LLLMs. It died because it was driven to the ground then sold private equity and about to be sold again (mark my words)

Dog barking is, like, 1% of the findings. They also claim the TV is:

1. taking screenshots of your screen 2. fingerpriting devices on your local network 3. connects to bluetooth mics in the room and recording audio without asking etc.

They do mention it in the article

“To build Microsoft-Decision-1, we post trained Qwen3.5-9B”

Time to do what? Watch more Netflix, doomscroll, procrastinate?

Don’t fool yourself, we’re not exactly curing cancer.

I’d rather solve a tech puzzle by hand.

Thanks you for this comment.

I’m bad at throwing parties and I’m a bad cook.

So instead I invite friends/family to stay over. Even with kids.

Thats also very gratofying, play some board games, sit next to the fire and then have breakfast together.

Best way to copē with the world at it’s current state.

(Also a European here, mildly affectrd ny war)

I maintain a popular Saml library for NET (aspnetsaml). And yep, I made that rookie mistake too

same. "macOS Tahoe 26+" requirement is a bummer.