shouldiuse.io

Categories

VERDICT

Should I use VS Code Marketplace?

Extension gallery for Visual Studio Code (page tagline unavailable) - marketplace.visualstudio.com

Depends. There is nothing to buy — this is the free default extension gallery for VS Code, so use it if you run VS Code proper. Skip it if you are on a fork like Cursor (which migrated to OpenVSX) or need vetted-only extensions; supplied sources were thin, so confidence is low.

Confidence

Low. Based on 3 usable public sources; most supplied evidence covered unrelated marketplaces (Facebook, AWS, G2, WCFM).

Ratings

  • Value for moneyNo pricing evidence in sources reviewed
  • Ease of useNo usability evidence in sources reviewed
  • Feature depthNo feature evidence in sources reviewed
  • Support qualityNo support evidence in sources reviewed
  • Security posture

Pricing

Not disclosed

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed

Best for

  • Daily VS Code users
  • Developers wanting one-click extension installs
  • Teams standardizing on VS Code

Not for

  • VS Code fork users — Cursor et al. migrated to OpenVSX
  • Guess: security-strict teams needing vetted-only extensions
  • Buyers shopping for purchasable software — nothing to buy here
  • Guess: non-VS Code editor users (JetBrains, Emacs)

Gotchas - check before you buy

high

Supply-chain risk: researchers reported a critical VSCode extension vulnerability

medium

Fork lock-in: Cursor had to migrate its extension sourcing to OpenVSX

Pros and cons

Pros

  • Publishes an official product security page

Cons

  • Critical VSCode extension vulnerability reported on r/cybersecurity
  • Cursor fork forced to migrate its marketplace to OpenVSX

Sources & method

Analyzed 9/29/2026 - 3 sources - Official security page published; community sources report one critical extension supply-chain vulnerability.

official x1security x1news x1
  • Critical VSCode extension vulnerability, Reddit thread titled 'One Extension to Own Them All: Critical VSCode...' describes a critical extension vulnerability; snippet truncated, scope unverified.

Key stats

  • Security posture: 3/5

    Rating

  • Not disclosed

    Starting price

  • 3

    Sources

  • Analyzed

  • Value for money. No pricing evidence in sources reviewed
  • Ease of use. No usability evidence in sources reviewed
  • Feature depth. No feature evidence in sources reviewed
  • Support quality. No support evidence in sources reviewed
  • Security posture: 3/5. Security page exists; critical extension flaw reported

Pricing

Not disclosed

Security

Official security page published; community sources report one critical extension supply-chain vulnerability.

  • Critical VSCode extension vulnerabilityReddit thread titled 'One Extension to Own Them All: Critical VSCode...' describes a critical extension vulnerability; snippet truncated, scope unverified.³

What users say

No substantive user reviews of the VS Code Marketplace itself appear in the sources; most cover unrelated marketplaces.

Companies that could

  • Cursor² Uses Open VSX Registry instead
Full analysis

Based on 3 usable public sources; most supplied evidence covered unrelated marketplaces (Facebook, AWS, G2, WCFM).

Free, default extension gallery for VS Code — nothing to buy. Cursor fork locked out; uses OpenVSX instead.

Methodology

Based on 3 usable public sources; most supplied evidence covered unrelated marketplaces (Facebook, AWS, G2, WCFM).

Sources

  1. Product security page — Visual Studio Marketplacemarketplace.visualstudio.com
    official
  2. Extension Marketplace Changes — Transition to OpenVSX (Cursor Forum)forum.cursor.com
    news
  3. One Extension to Own Them All: Critical VSCode Extension Vulnerability (r/cybersecurity)reddit.com
    security

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.