OpenVSX
A vendor-neutral, open-source VS Code extension marketplace led by the Eclipse Foundation. It provides VS Code-derived editors such as VSCodium and Gitpod with an extension distribution channel that does not depend on Microsoft's official marketplace. It employs community-based review and public oversight mechanisms.
Timeline (last 90 days)
The malicious package appeared at Cursor's channel layer, and there is no evidence that OpenVSX, the Microsoft marketplace, or Anthropic's official packages were compromised.
The Claude Code extensions of the same name on npm and OpenVSX are both normal packages; the problem appears only in the Cursor extension store.
OpenVSX is a vendor-neutral, open-source VS Code extension marketplace led by the Eclipse Foundation, aimed at providing VS Code derivative editors with an extension distribution channel that does not depend on Microsoft's official marketplace.
OpenVSX adopts community-based operation and a relatively transparent review process; any organization or individual can publish extensions, and it accepts public community oversight and reports.
All Facts (4)
The malicious package appeared at Cursor's channel layer, and there is no evidence that OpenVSX, the Microsoft marketplace, or Anthropic's official packages were compromised.
50%UnverifiedThe Claude Code extensions of the same name on npm and OpenVSX are both normal packages; the problem appears only in the Cursor extension store.
50%UnverifiedOpenVSX is a vendor-neutral, open-source VS Code extension marketplace led by the Eclipse Foundation, aimed at providing VS Code derivative editors with an extension distribution channel that does not depend on Microsoft's official marketplace.
50%UnverifiedOpenVSX adopts community-based operation and a relatively transparent review process; any organization or individual can publish extensions, and it accepts public community oversight and reports.
50%