Cursor's "marketplace proxy" is, by definition, an MitM of Open VSX. Why on earth is that trustworthy to its users? Is it some mashup of Open VSX Connect and an API endpoint that merges their private marketplace with the public one? And what's so special about Cursor's CC extension implementation that they couldn't just serve the "real" one?

Or are they using an Open VSX Managed Registry hosted by the Eclipse Foundation, in which case this is potentially a bigger deal?