If it defaulted to a week then it actually would have helped mitigated the spread. But it defaults to 2 hours, so there was a 9 hour window during prime US working hours yesterday when machines would have been auto-updating to the compromised extension.

Though Anthropic is claiming that the compromised package was published solely to Cursor’s marketplace, not not Microsoft’s.

I started experimenting with more traditional text editors since last spring and am happy to say, that I’m a happy user of Neovim now.

Does anyone know Microsoft's justification for that policy?

Wtf. That’s its own scandal

[dead]