Apparently it is public: https://cursor.com/help/customization/extensions
replyThey use a proxy in front of OpenVSX…purportedly for better security, the irony writes itself.
Ironically, that page has a paragraph "How Cursor reduces supply-chain risk:"
replyWhich is exactly the opposite of what happened today.
well maybe they did reduce supply chain risk, but still need to reduce it some more
reply> Team admins can defer extension installs and updates until a marketplace version has been published for a minimum number of hours.
replyI think everyone is going to be setting this to 168 after today.
Yeah, their blog post is not very transparent at what happened here. Does not instill trust.
replyYes. Cursor marketplace is a mirror of Open VSX except they inject some plugins that are not in Open VSX for some reason. This works because Open VSX has basically no security. Which was already an issue.
reply