Comment by nunez

Kind of surprised that Cursor doesn't do checksum verification for plugins. That would have stopped this completely. (Unless it does and this backdoor is more theoretical than anything else.)