Just did a quick search, OpenVSX has no extension signing?, no verifications?, what year is this...

This could have been avoided by having extensions signed by company doing them with keys and review

A lot of this is turning into “well other company said” but Anthropic claims OpenVSX is fine?[1] And that Cursor has their own market place. I’m confused.

> Dworken from Anthropic here, that is correct: This only impacted the extension as it was hosted on the Cursor marketplace. It did not impact the official VS Code extension marketplace or OpenVSX. Users of Claude Code on VS Code are not impacted by this issue.

1: https://news.ycombinator.com/item?id=50304585

Cursor has their own mirror of OpenVSX. Some reporting suggests the tampered files were on the Cursor mirror but not the main OpenVSX. (This is shown, among other things, by the Anysphere plugins available in the Cursor mirror but not in OpenVSX.)

Edit: It seems Cursor is claiming the tampered files were only in their mirror.

Sort of hoping it's Anthropic and their specific OpenVSX account credentials. As opposed to the worse case of an OpenVSX flaw that's broader. A ton of AI-enabled IDEs are VsCodium forks pointed at OpenVSX...Cursor, Anti Gravity, Kiro, Trae, Devin, etc.

You're ignoring the "or" which is doing a lot of work.

Anthropic's position is seemingly that it was "another part of the publishing process [that] was compromised"

[flagged]

The hacks and vluns are blending into a blur for me now -- why is Binance confirming Anthropic compromise while they have their own $6 Billion compromise to look at /s

Vibecoders are safu