@Ffforward @GossiTheDog What they published to Cursor's marketplace is tantamount to a fix, is it not? Even if it's equivalent to the prior version.

What remains unknown is the nature of the compromise leading to the malicious Cursor package.

@GossiTheDog Concur. I think the distribution of the fix to all marketplaces is leading to confusion.

@GossiTheDog Yeah there's some confusion here, because as Socket notes, the upload should leave a footprint: https://socket.dev/blog/claude-code-extension-compromise?utm_medium=feed#Open-VSX-Has-No-Publication-Record-for-2.1.313

@GossiTheDog So you have confirmation that the malicious package was uploaded to all of the extension marketplaces, not just Cursor?

@badsamurai .zip about to have a lot of friends on some lists.

Waitaminit...