I understood that it was not the official extension, is just cursor allowed a random to call themselves "anthropic" and publish an "official π" extension
The victims were lucky: the attacker was not skilled enough as the script wanted root access to enable ssh on :22 and it failed in most cases, infecting only the idiots running a vibe code tool as root