/
affected_products:Cursor × latest_source_host:safedep.io × limpar

Resultados

2 casos · pág. 1/1

safedep.io · medium

Cursor's VS Code import installs latest Open VSX extension versions, exposing agentic IDE users to supply chain risk

SafeDep research shows that Cursor's Import VS Code Configuration step copies only the publisher.extensionname of each installed extension and drops the version. Cursor then installs whatever version Open VSX (run by the Eclipse Foundation) calls latest, through its proxy marketplace.cursorapi.com. In SafeDep's test, three extensions pinn…

technology
safedep.io · low

SafeDep tests Jev and Gryph to flag malicious actions by compromised AI coding agents such as Claude Code

A SafeDep researcher describes an experiment that uses Gryph (an audit trail for AI coding agents) and TypeSafe AI's Jev model to separate a developer's normal agent activity from attacks. The article cites threats to agents such as Claude Code and Codex: the Mini Shai-Hulud worm commits Claude Code hooks into repositories, malicious npm …

technology software development