VS Code doesn't allow forks to use their marketplace, I think. At least with VSCodium, they don't. I think they even patch a workaround where you could download almost all extensions' .vsix files.

1. If only Cursor Marketplace version was compromised, how was it published in the first place?

2. If the Cursor Marketplace version was released from an "official Anthropic" account, whose to say OpenVSX and/or VSCode versions are not compromised?

The affected versions have been pulled down, so no one really knows. The way I see it, only Cursor has admitted to have been compromised.