wouldn't the attack vector be like this:

I find a github repo, I want to contribute to it. I clone it, open up cursor, make an edit, commit, and boom, I am infected.

You can leave out cursor and it would do the same thing.

skeledrew 3 hours ago | parent | prev | next [-]

From my reading, boom happens at "open up cursor".

Illniyar 3 hours ago | parent | prev [-]

you would only need to open it to be exploited, not edit or prompt. Allegedly

	▲	dalemhurley 3 hours ago \| parent [-]
		From the article it occurs when Cursor is loaded. iDEs do a lot of stuff when they first open.