It looks like the screenshot was an actual photo of someone's monitor. I'm left wondering why print screen wasn't utilized. And for some reason it really makes me not want to touch this project.

Looking at the metadata it says it is a Gnome screenshot. What a pointless and incorrect non-sequitor.

  exiftool -a -u -g1 ~/Downloads/screenshot.png

  ---- ExifTool ----
  ExifTool Version Number         : 13.55
  ---- System ----
  File Name                       : screenshot.png
  Directory                       : XXX
  File Size                       : 1260 kB
  File Modification Date/Time     : 2026:08:11 16:24:37-04:00
  File Access Date/Time           : 2026:08:11 16:24:41-04:00
  File Inode Change Date/Time     : 2026:08:11 16:24:41-04:00
  File Permissions                : -rw-r--r--
  ---- File ----
  File Type                       : PNG
  File Type Extension             : png
  MIME Type                       : image/png
  ---- PNG ----
  Image Width                     : 2351
  Image Height                    : 1388
  Bit Depth                       : 8
  Color Type                      : RGB with Alpha
  Compression                     : Deflate/Inflate
  Filter                          : Adaptive
  Interlace                       : Noninterlaced
  Significant Bits                : 8 8 8 8
  Software                        : gnome-screenshot
  Creation Time                   : Mon 10 Aug 2026 10:19:53 PM +03
  ---- Composite ----
  Image Size                      : 2351x1388
  Megapixels                      : 3.3

To be fair, it does really look like a photo of a monitor.

I didn't think that at all. There weren't even any lightning artifacts or glare or anything.

I thought it was a semi-transparent window until I read this. The curvature makes that clear, wow!

There is no curvature in the screenshot, only a semitransparent background

it is a actually a screenshot, that's zorin's window transparency doing that

Look again.

I think you're off by about 90 orders of magnitude for the actual heat death

This doesn't require anyone placing anything deliberately on your machine (as in, needing to exploit it somehow ahead of time). It could be as simple as checking out a branch to review, where the author of the branch has added the .exe.

I'd say checking out a malicious branch is in the same category as downloading a malicious attachment. By which I mean, it's kinda on you.

Okay... but when "you" is a junior engineer on your team and now you are suddenly spending your entire weekend dealing with malware, it's kinda on you as well.

Downloading this attachement doesn't executes it. Checking out a branch in this case executes the file in the branch. Thats a big difference.

In this case, if you just run a git command yourself it executes the file as well.

On windows I guess?

On Linux and MacOS you'd need to run ./git to execute a malicious binary in the cloned repo.

A lot of malware was delivered back in the day via Windows AutoPlay feature. Someone plugs a USB drive in and bam, they are immediately exploited. You could say it's always a problem if the USB drive is already full of malware. However, Microsoft disabled AutoPlay in Windows 7 (and backported this fix) specifically to address this vulnerability.

This exploit feels very similar to me. I don't know if there's a specific name for this classification of AutoPlay issues.

They should definitely fix it, but that's mostly because its an "unnecessary autoplay" so to speak. There's plenty of "necessary autoplays" out there, and AI is going to add more and more every day, because that's where productivity comes from. But, why Cursor would ever need to execute the git binary in your project directory is beyond me; very clearly a bug.

Their ignorance of the bug report is also very clear and concerning negligence.

But I think simultaneously, the security team is making a mountain out of a molehill. This is a classic thing security teams love doing; everything is military defcon P0. So, its important to check them regularly, and remind them that the most secure system is no system; they are but one part of a greater ecosystem.

It has nothing to do with npm. However, a binary could be configured to extract your git/npm secrets using this exploit, which could then lead to a npm supply chain attack (or pip, etc. etc.).

I meant the attack would be the other way around- if an infected package had the git.exe file in their root.

Or, the infected package could also copy that file into the parent project's root.

Oh yeah that's a good point - two layers of auto executing scripts/binaries.

Joe Arpaio was not removed from office. He was charged with contempt but was never incarcerated. He was pardoned and then lost his next election.

That might be a loophole, but in this case I don't think it matters. The emergency powers let the president do whatever they want at this point. And even if there is a law preventing endless war, Congress is completely fine with it, and has been for decades.

Vermont doesn't allow it either and it remains the most beautiful state IMO

What would be really awesome is some sort of feature where, once self hosted, I can generate a package or link that will download + install + pre-configure the login. Basically a bespoke installer/setup script. that can be linked to a particular person. The goal being to make onboarding as frictionless as possible. This could have some security implications maybe (the link is shared by mistake), but for a small self-hosted instance, that seems like something that could be mitigated fairly easily. Maybe only works with local accounts or something.

That would really make it easy to send a friend a link, "hey come chat with me", without having to worry about a response such as, "I'm already on discord, I don't want to set up all that stuff".

What would you expect that to do beyond a "here's a link to the instance, sign up there"? You can combine it with Discord-like roles and gate channel visibility and rights on that, so even if someone else would sign up you just wouldn't give them the "in-group" role for example. Are you thinking of an "invitation" type link with a one time token or something?

I’m wondering too, the closest thing I can think of is maybe Zoom? It goes from link to opening your meeting *relatively* smoothly when the client needs to be installed.

Right, I'm thinking along the same lines as what Zoom offers. Except with the additional feature that the link is custom tailored to a known, pre-configured user. So you also skip the "log in as guest or create an account" step.

There is an audience for this, and it's me and my friends.

I have a small group of close friends. We are on discord just about every day, but we really don't bother with anyone outside our group, other than the very occasional invitation to another friend/coworker to join for some games.

We don't care about network effect, social media features, engagement, etc. We just want a well made application for private text, voice, and video that we never have to actually think about.

And no, matrix is not that.