Always has been because there is so far zero liability for anything someone programs and distributes commercially. That's the single root cause. If not that software wouldn't be in general such major shit show. What we have is the result of being allowed to throw out even the most toxic shit out without any consequences if it causes damage, no mater how large the damage is. Software companies caused so far over the decades likely hundreds of billions, or even a few trillion damages in sum, yet nobody responsible ever got the bill. It's wild west—since now over 60 years. This has to stop finally!
Let's see where things will move as soon as we have regular product liability for software:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum...
Just a few days left! Looking forward.
This is going to cause some major argument between the EU and the US, maybe even a trade war. Trouble is already underway:
https://www.reuters.com/legal/government/us-lawmakers-urge-t...
Despite that I also think that this is the right and long overdue move on the EU side. We need to break the basic pattern that nobody cares as long as the responsible effectively never get the bill when they mess up.
Software is "Unsafe at Any Speed" [ https://en.wikipedia.org/wiki/Unsafe_at_Any_Speed ] to bring a striking analogy — even we have since about 60 years the tech to build software which provably (in the mathematical sense) matches its specification. Still what you have on the market is utter garbage, and instead of getting better it gets currently actually worse with lowering the garbage quality level even more with "AI" slop. That EU legislation could become the escape hatch; that's why I'm looking forward.
Under the new legislation software products become regular products; there is no liability exception any more.
If you commercially distribute defective products to end user you're in general liable for the damages these defective products cause. This now includes pure software just as any other (physical) product on the market.
If you don't know how product liability generally works in the EU, and what this means for software see here:
https://cms.law/en/int/publication/the-new-eu-product-liabil...
edit: VSCode has a verified marker for publishers but I don't know how that works or if Cursor does the same.
Also, a basic scan of the package would have flagged an ssh backdoor, no? It didn't seem to me like its obfuscation was very sophisticated.
Scanning is a curious one. It's not always obvious because developer tools have legitimate reasons to do a lot of these things. LLMs are better at understanding what it's actually doing now though so that might have worked. But who knows, people have snuck in backdoors into many things before.
They don’t do organization verification, but they do verify where code comes from. You may be sure that packages are built by alpine, which made sure that the dist files comes from the sources that the maintainers added, and the latter ensure that the sources are correct. In truth, it’s a very small circle of trust.