You could make it a requirement only for people who want to attribute “made by”. If you publish a no name extension, you could skip it.

You don't need to force everyone, both an coexist in this context. I do believe a company with nearly a trillion dollars of planned expenditure can afford to buy a domain and renew it prior to expiration.

Then you would have the same problem. Anthropic has no presence on the Cursor Marketplace, so what is stopping someone from claiming the name and just not associating a domain name?

Nothing, but that extension would be flagged as "unknown" or "third-party" source or something and you'd get a big warning before proceeding to install it.

Also, a basic scan of the package would have flagged an ssh backdoor, no? It didn't seem to me like its obfuscation was very sophisticated.

A big danger warning before installing extensions is a great way to kill your FOSS extension crowd off. Verifying ownership of a domain doesn't even guarantee that anything about the extension is trustworthy. People get phished all the time and skip through warnings.

Scanning is a curious one. It's not always obvious because developer tools have legitimate reasons to do a lot of these things. LLMs are better at understanding what it's actually doing now though so that might have worked. But who knows, people have snuck in backdoors into many things before.

Literally "Made by <verified domain name>" would go a long way. Cursor is just making poor technical decisions. But then I'm sure we'd have a news story about homoglyph attacks on Cursor.