Comment by darkwi11ow
1 day ago
Yeah OpenVSX security is a joke, they also have dumb search algorithm which allows for easy squatting of similar-looking extension names so they show up in search first when you look for official extensions. There were quite a few prominent hacks done that way. I think Microsoft likes OpenVSX situation because it allows them to claim their proprietary VSCode marketplace to be more secure.
Vscode(ium) extensions are also pretty weak security wise in general. There's little guardrails on what an extension can do.
On publishing, I do see that the MS marketplace has much better typosquatting and rogue publisher protection. It's unclear to me how much better their SAST/scanning is than OpenVSX. Both have something, but both have been fooled many times, and recently.
Then why even allow employees to use that?
Binance got a pretty expensive lesson if that was the cause for their recent hack
There is no alternative really. Cursor was the market leader in LLM-assisted IDE experience before SpaceX acquisition, though Elon nerfed the product a lot in recent months. And there is still no good alternative to it. Google tries to compete via Antigravity, but that also uses OpenVSX. I myself use Cursor and use Claude there installed via OpenVSX, and was not affected only thanks to my laziness (I saw upgrade button, but became distracted and did not click). I hope this situation will become a trigger to improve OpenVSX security.
Why not use claude code directly?
Why risk getting compromised like that?
2 replies →