{"slug": "open-vsx", "name": "Open VSX", "category": "browsers", "category_name": "Browsers and extensions", "description": "", "recommenders": 3, "commenters": 10, "warners": 2, "score": 2.186, "rising": 0.35, "first": "2025-11-19", "latest": "2026-10-31", "why": "I've not struggled to find the things I need at https://open-vsx.org", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 5, "compare": 0, "warn": 2}, "spark": [0, 1, 0, 0, 1, 0, 0, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I've not struggled to find the things I need at https://open-vsx.org", "kind": "", "icon": true, "domain": "open-vsx.org", "github_repo": null, "official_url": "https://open-vsx.org", "pricing": "", "aliases": ["Open VSX", "OpenVSX"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 791946786, "item_id": 49496674, "url": "https://news.ycombinator.com/item?id=49496674", "by": "ab_wahab01", "date": "2026-08-30", "version": null, "stance": "recommend", "quote": "While Open VSX is great", "excerpt": "VSCodium defaults to the Open VSX Registry instead of Microsoft's official marketplace. While Open VSX is great, sometimes an extension you need for work or study (or if you want to use official extensions risk-free) is only available on the official VS Code marketplace. I created a small extension for switching between the two marketplaces. check - https://open-vsx.org/extension/AbdulOhab/source-swap Source Code: ht", "context": "", "use_case": "extension registry", "switched_from": "", "story": "Switch VSCodium Between Open VSX and MS Marketplace"}, {"id": 759100128, "item_id": 47443758, "url": "https://news.ycombinator.com/item?id=47443758", "by": "barnabee", "date": "2026-03-19", "version": null, "stance": "recommend", "quote": "I've not struggled to find the things I need at https://open-vsx.org", "excerpt": "I've not struggled to find the things I need at https://open-vsx.org (usually by searching directly within VSCodium), but then I only use it for editing things like markdown docs and presentations, LaTeX/Typst, rather than coding, which I prefer to do in a terminal and with a modal editor.", "context": "", "use_case": "VS Code extension registry", "switched_from": "", "story": "Astral to Join OpenAI"}, {"id": 740815360, "item_id": 46300960, "url": "https://news.ycombinator.com/item?id=46300960", "by": "duskdozer", "date": "2025-12-17", "version": null, "stance": "recommend", "quote": "There's https://open-vsx.org/.", "excerpt": "There's https://open-vsx.org/. I've seen in the repo people talk about tweaking workarounds to use the proprietary MS stuff.", "context": "", "use_case": "", "switched_from": "", "story": "VS Code deactivates IntelliCode in favor of the paid Copilot"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 804851760, "item_id": 50303235, "url": "https://news.ycombinator.com/item?id=50303235", "by": "reilly3000", "date": "2026-10-30", "version": null, "stance": "warn", "quote": "https://open-vsx.org/ is where the attack took place", "excerpt": "My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power\u2019s all of the VSCode fork\u2019s extensions needs.", "context": "", "use_case": "", "switched_from": "", "story": "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace"}, {"id": 771418225, "item_id": 48213639, "url": "https://news.ycombinator.com/item?id=48213639", "by": "nightpool", "date": "2026-05-20", "version": null, "stance": "warn", "quote": "I wonder if it was open-vsx specific?", "excerpt": "I'm not seeing anything on the official marketplace: https://marketplace.visualstudio.com/items?itemName=whatwedo.twig I wonder if it was open-vsx specific?", "context": "", "use_case": "", "switched_from": "", "story": "GitHub confirms breach of 3,800 repos via malicious VSCode extension"}]}], "who": [], "tags": [], "use_cases": ["extension registry", "vs code extension registry"], "compared": [{"slug": "vscodium", "name": "VSCodium", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "cursor", "name": "Cursor", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "visual-studio-code", "name": "Visual Studio Code", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50300683", "title": "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=49496673", "title": "Switch VSCodium Between Open VSX and MS Marketplace", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48207660", "title": "GitHub confirms breach of 3,800 repos via malicious VSCode extension", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47438723", "title": "Astral to Join OpenAI", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46286383", "title": "VS Code deactivates IntelliCode in favor of the paid Copilot", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=45983487", "title": "Visual Studio Code Private Marketplace: Your Team's Secure+Curated Extension Hub", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {"recommend": 1}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 1}, "2026-04": {}, "2026-05": {"warn": 1}, "2026-06": {}, "2026-07": {}, "2026-08": {"recommend": 1}, "2026-09": {}, "2026-10": {"warn": 1, "neutral": 4}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 804995345, "item_id": 50312209, "url": "https://news.ycombinator.com/item?id=50312209", "by": "zbentley", "date": "2026-10-31", "version": null, "stance": "neutral", "quote": "", "excerpt": "It seems like they put a proxy in front of OpenVSX: https://cursor.com/help/customization/extensions However, statements around the internet (and in these comments) are less than definitive as to whether a) that proxy has a cache that was compromised; b) that proxy has select extensions which can be published directly to it by hand (one of which was compromised); c) other.", "context": "", "use_case": "", "switched_from": "", "story": "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace"}, {"id": 804945122, "item_id": 50309070, "url": "https://news.ycombinator.com/item?id=50309070", "by": "tyingq", "date": "2026-10-30", "version": null, "stance": "neutral", "quote": "OpenVSX does have an option to use OIDC instead of a long lived token for publishing.", "excerpt": "OpenVSX does have an option to use OIDC instead of a long lived token for publishing. I get the feeling a lot of people use the forever-good-unless-revoked token though. https://github.com/eclipse-openvsx/openvsx/wiki/Trusted-Publishing Edit: Ah, guess it was not open-vsx, but a in-house Cursor marketplace. https://news.ycombinator.com/item?id=50304129", "context": "", "use_case": "", "switched_from": "", "story": "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace"}, {"id": 804872945, "item_id": 50304559, "url": "https://news.ycombinator.com/item?id=50304559", "by": "wky", "date": "2026-10-30", "version": null, "stance": "neutral", "quote": "Cursor Marketplace is OpenVSX + their own proxy", "excerpt": "Even more confusing is apparently Cursor Marketplace is OpenVSX + their own proxy to add extensions on top[0], so there are at least two possible cases: 1. The compromised version was present on OpenVSX itself, and Cursor Marketplace proxied to it 2. The compromised version was on Cursor's proxy, not OpenVSX itself [0] https://cursor.com/help/customization/extensions", "context": "", "use_case": "", "switched_from": "", "story": "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace"}, {"id": 804864849, "item_id": 50304053, "url": "https://news.ycombinator.com/item?id=50304053", "by": "mirashii", "date": "2026-10-30", "version": null, "stance": "neutral", "quote": "", "excerpt": "Cursor didn\u2019t always use Open VSX, it changed in late 2025. https://forum.cursor.com/t/extension-marketplace-changes-transition-to-openvsx/109138 Also worth noting that it doesn\u2019t use Open VSX directly but uses a cursor hosted mirror at https://marketplace.cursorapi.com/open-vsx-mirror", "context": "", "use_case": "", "switched_from": "", "story": "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace"}, {"id": 804851760, "item_id": 50303235, "url": "https://news.ycombinator.com/item?id=50303235", "by": "reilly3000", "date": "2026-10-30", "version": null, "stance": "warn", "quote": "https://open-vsx.org/ is where the attack took place", "excerpt": "My tin foil hat says MSFT stands the most to gain my this. https://open-vsx.org/ is where the attack took place, and that power\u2019s all of the VSCode fork\u2019s extensions needs.", "context": "", "use_case": "", "switched_from": "", "story": "Backdoor in Claude Code for VS Code extension on the Cursor Marketplace"}, {"id": 791946786, "item_id": 49496674, "url": "https://news.ycombinator.com/item?id=49496674", "by": "ab_wahab01", "date": "2026-08-30", "version": null, "stance": "recommend", "quote": "While Open VSX is great", "excerpt": "VSCodium defaults to the Open VSX Registry instead of Microsoft's official marketplace. While Open VSX is great, sometimes an extension you need for work or study (or if you want to use official extensions risk-free) is only available on the official VS Code marketplace. I created a small extension for switching between the two marketplaces. check - https://open-vsx.org/extension/AbdulOhab/source-swap Source Code: ht", "context": "", "use_case": "extension registry", "switched_from": "", "story": "Switch VSCodium Between Open VSX and MS Marketplace"}, {"id": 771418225, "item_id": 48213639, "url": "https://news.ycombinator.com/item?id=48213639", "by": "nightpool", "date": "2026-05-20", "version": null, "stance": "warn", "quote": "I wonder if it was open-vsx specific?", "excerpt": "I'm not seeing anything on the official marketplace: https://marketplace.visualstudio.com/items?itemName=whatwedo.twig I wonder if it was open-vsx specific?", "context": "", "use_case": "", "switched_from": "", "story": "GitHub confirms breach of 3,800 repos via malicious VSCode extension"}, {"id": 759100128, "item_id": 47443758, "url": "https://news.ycombinator.com/item?id=47443758", "by": "barnabee", "date": "2026-03-19", "version": null, "stance": "recommend", "quote": "I've not struggled to find the things I need at https://open-vsx.org", "excerpt": "I've not struggled to find the things I need at https://open-vsx.org (usually by searching directly within VSCodium), but then I only use it for editing things like markdown docs and presentations, LaTeX/Typst, rather than coding, which I prefer to do in a terminal and with a modal editor.", "context": "", "use_case": "VS Code extension registry", "switched_from": "", "story": "Astral to Join OpenAI"}, {"id": 740815360, "item_id": 46300960, "url": "https://news.ycombinator.com/item?id=46300960", "by": "duskdozer", "date": "2025-12-17", "version": null, "stance": "recommend", "quote": "There's https://open-vsx.org/.", "excerpt": "There's https://open-vsx.org/. I've seen in the repo people talk about tweaking workarounds to use the proprietary MS stuff.", "context": "", "use_case": "", "switched_from": "", "story": "VS Code deactivates IntelliCode in favor of the paid Copilot"}, {"id": 735750560, "item_id": 45984410, "url": "https://news.ycombinator.com/item?id=45984410", "by": "verdverm", "date": "2025-11-19", "version": null, "stance": "neutral", "quote": "There's also an open marketplace: https://open-vsx.org/", "excerpt": "There's also an open marketplace: https://open-vsx.org/", "context": "", "use_case": "", "switched_from": "", "story": "Visual Studio Code Private Marketplace: Your Team's Secure+Curated Extension Hub"}]}