Comment by viraptor
1 day ago
This is a cheap troll, but just in case someone is wondering: This extension likely never hit the standard workflow and/or repository. Most likely someone got the credentials and uploaded a locally modified version. No review system at anthropic has seen this version.
Why wouldn't their review system see a published extension and determine the very second it's published that it didn't match the results of a standard workflow?
Because it wasn't published by them or hosted on a system they control, it was done directly on Cursor's mirror of OpenVSX with a modified copy of the original extension.
> someone got the credentials
> No review system at anthropic has seen this
Weird flex
I'm not sure where you see the flex. If someone gets hold of the token allowing the upload of your app to the store, it's completely irrelevant how good your internal code/review systems are. They've been completely bypassed and never triggered.
Arguably, your security shouldn't stop at internal code review and should aim at protecting key distribution platforms credentials and assets that are pushed to your users.
2 replies →
As an aside, it would be neat if publishing services like this had a sort of 2FA, eg the package manager had a hook endpoint where it sent the details of the next requested published version. Allowing the owners to validate.
Kinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.
It's legitimate question, it's the promise they are selling and doing IPO based off those promises.
Why don't they have their super intelligence looking thru it? If company selling those promises can't even do it for themselves, this is very suspicious
Who is "they"? This is a third party registry.
Intelligence that powerful and for them too cheap to meter and their review system couldn't be bothered.
That wasn't a cheap troll. What they distribute and what Claude Code installs is on them. You're supposed to keep your channels clean and secure.
At a minimum they should monitor the larger marketplaces even if they're not in the chain.