I think you’re being extremely negative towards Anthropic here. Basically the parent is saying “this is a problem at Cursor and not Anthropic” and you’re holding them accountable.

You’re literally saying that they should not have published on the Cursor marketplace but should have used OpenVSX because that would have been “reasonable”, but I think you’re being unreasonable here.

Since this morning I've seen a dozen "Anthropic hacked!!!" articles upvoted to the front page. There's really no use arguing with the mob. People will make up their own realities because they desperately want it to be true.

Doesn't HN have mods to correct article titles in cases like this? 7 hours in and I see "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace"

19 hours in and it's still the same, I don't understand why it's not being updated

Are you really surprised they've created ill-will?

Dworken from Anthropic here, I just want to be clear: OpenVSX was not impacted in this incident, the impacted system was only the Cursor marketplace that they host. We have confirmed that no Anthropic systems or employee devices are involved in this.

Thanks for the clarification. Remaining question is then: why was version 2.1.313 yanked from both OpenVSX and the Cursor Marketplace then?

As discussed here:

https://cyberplace.social/@GossiTheDog/117528831681803563

and as can be seen as there is no version 2.1.313 here: https://open-vsx.org/extension/Anthropic/claude-code/2.1.313

but there is https://open-vsx.org/extension/Anthropic/claude-code/2.1.314 https://open-vsx.org/extension/Anthropic/claude-code/2.1.312

Dworken from Anthropic here, 2.1.313 was never published on OpenVSX, the VS Code marketplace, or on any of our official hosts. The malicious actor here had published a fake version of this extension on Cursor's marketplace. In order to disambiguate, we made sure our next update was 2.1.314.

There was no 313 release https://github.com/anthropics/claude-code/releases

By this you mean Anthropic is now accountable to secure Elon's marketplace offerings. I'm not sure that is reasonable.