Cursor extension import silently swaps versions, raising supply chain risks

When users import VS Code extensions into Cursor, the tool copies only extension names, not versions, and installs whatever the Open VSX registry calls latest. Security researchers warn this creates a supply-chain attack vector, as the same extension name can point to different code in different stores.

Bottom line — SafeDep found three pinned extensions all silently upgraded to Open VSX's latest versions during import.

Go deeper (8)

• Cursor routes extension downloads through its own proxy (marketplace.cursorapi.com), which fetches from Open VSX, per SafeDep's analysis.
• Microsoft's terms forbid VS Code forks from using its marketplace, so Cursor relies on Open VSX, a registry run by the Eclipse Foundation, SafeDep explains.
• Open VSX uses a bot account to publish many extensions; Koi Security reported a stolen publishing token in May 2025, fixed in June 2025, per SafeDep.
• Cursor's help page warns that the same publisher.extension name can point to different publishers or code on Open VSX than on Microsoft's store, SafeDep notes.
• Some Microsoft-owned extensions like Pylance are unavailable on Open VSX; Cursor substitutes its own Anysphere-published version under the same name, SafeDep reports.
• In late November 2025, Koi Security found unclaimed extension names that Cursor recommended; Cursor fixed the issue on 1 December 2025, per SafeDep.
• Chrome's extension update mechanism checks for updates on startup and every few hours, but only installs them when the extension is idle, per Chrome for Developers.
• Enterprise administrators can pin extensions to specific versions via the Google Admin console, overriding automatic updates, Chrome for Developers states.

Read the reporting