FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"
Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.
Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.
Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.
They would have done this in a heartbeat to anyone that they’re not reliant on for compute.
Anthropic is incapable of communicating. They rely on random employees in random threads on random social media to do some kind of PR and posts. Regardless of the issue. Or even non-issues but features.
In general, they need to make a really big post somewhere that’s not a HN comment that this was in fact a compromise of the Cursor marketplace, not an employee’s machine, because they’re getting a lot of (unjustified) bad PR.
1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it
2. The compromised version was on Cursor's proxy, not OpenVSX itself
here is the ddworken comment confirming https://news.ycombinator.com/item?id=50300683#50305148