Had the tool been up longer than the 11 hours the malware was live? If not, then why would Anthropic try to get it marked as unofficial, as opposed to take it down?
Or are you saying that every author and publisher should request Cursor to mark their extensions on the Cursor vsx pass-through as unofficial?