Hacker News Reader

Perhaps its a intentional back door?

NSA/FBI puts a git.exe in GitHub for a target. Target pulls the repo and it executes the payload.

As Cursor is/was based on VS Code, does it happen in VS Code too?

It’s a thing in VSCode as well/has been a thing or things similar to it : https://www.threatlocker.com/blog/malicious-vs-code-tasks-js... (2026)

https://www.reddit.com/r/programming/comments/zes1co/visual_... (2022)

I think those are both different in that they require the user to say they trust this code. Additionally the first is arguably not a bug (the code in tasks.json will indeed run if you say you trust the project) and the second was reported and fixed within two months.

Yes, my point was more so the underlying behavior of automatic execution of binaries associated with/inside of a git project exists already within vscode as a pattern, and so seeing cursor doing the same wouldn't be surprising.

Reply on news.ycombinator.com