I'm guessing it was the easiest quick workaround available, but obv wait for official confirmation.

Reads like Cursor's extension marketplace got compromised, hence how the OpenVSX and MS marketplaces can be unaffected.