alt Hacker NewsOk, so... Summing this up
- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)
Replies
Lazare • yesterday at 7:58 PM
Yes. Cursor marketplace is a mirror of Open VSX except they inject some plugins that are not in Open VSX for some reason. This works because Open VSX has basically no security. Which was already an issue.
Apparently it is public: https://cursor.com/help/customization/extensions
They use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.