Comment by jitbit
19 hours ago
Ok, so... Summing this up
- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)
Yeah, their blog post is not very transparent at what happened here. Does not instill trust.
Apparently it is public: https://cursor.com/help/customization/extensions
They use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.
Ironically, that page has a paragraph "How Cursor reduces supply-chain risk:"
Which is exactly the opposite of what happened today.
well maybe they did reduce supply chain risk, but still need to reduce it some more
> Team admins can defer extension installs and updates until a marketplace version has been published for a minimum number of hours.
I think everyone is going to be setting this to 168 after today.
Yes. Cursor marketplace is a mirror of Open VSX except they inject some plugins that are not in Open VSX for some reason. This works because Open VSX has basically no security. Which was already an issue.