Given they mentioned taking down and rebuilding the marketplace registry in that post, it seems equally likely that Cursor’s infrastructure was the source of the intrusion and a folks are jumping the gun on attribution.

Edit: I was correct. https://news.ycombinator.com/item?id=50304129