Unverified extensions security issue

[user209]

Describe the Bug

Currently there is no easy way to identify unverified extensions in cursor. There should be at least a warning.

Steps to Reproduce

As an example, there is a credentials grabber malware disguised as a popular VS Code extension with more than 1.8 million downloads on the VS Code Marketplace. On Open VSX, it shows 2 million downloads, while the original extension has only 64,000 downloads. Since unverified publishers appear identical to verified ones in the extensions UI, we’re just one click away from getting recked.

Expected Behavior

A clear warning must be displayed to indicate that the extension is unverified.

Screenshots / Screen Recordings

Operating System

All

Current Cursor Version (Menu → About Cursor → Copy)

All version are affected.

Does this stop you from using Cursor

No - Cursor works, but with this issue

[condor]

Hi @user209 and welcome to the Cursor Forum.

Thank you for the report. I would suggest contacting openVSX directly as they operate the marketplace.

[user209]

OpenVSX was notified before registering the bug. But it does not solve the problem in general case.

[condor]

Great, could you elaborate please on the ‘general case’?
Looking at Marketplace as a VSCode feature and in this case operated by OpenVSX.