/
← Voltar ao feed
medium technology

Cursor's VS Code import installs latest Open VSX extension versions, exposing agentic IDE users to supply chain risk

1 fonte(s) · 1 atualização(ões) · publicado 11/09/2026 07:00 · coletado há 1 dia

SafeDep research shows that Cursor's Import VS Code Configuration step copies only the publisher.extension_name of each installed extension and drops the version. Cursor then installs whatever version Open VSX (run by the Eclipse Foundation) calls latest, through its proxy marketplace.cursorapi.com. In SafeDep's test, three extensions pinned at old versions all came back at the Open VSX latest version. Because identical extension IDs can map to different publishers or code on Open VSX and the Microsoft Marketplace, and because auto update is on by default, the behavior widens the extension supply chain attack surface for developers on VS Code forks (Cursor, Windsurf, Google Antigravity). The article describes a risk and misconfiguration pattern, not a confirmed active campaign against Cursor users.

Technical Details

  • Cursor routes extension search and downloads through its own proxy. Open VSX-sourced files carry /open-vsx-mirror/ in the URL, while the few Cursor-hosted ones use /downloads/production/. Cursor's automated malware and supply chain checks can block an extension but do not influence which version is served.
  • Tested extensions: esbenp.prettier-vscode (12.4.0), formulahendry.code-runner (0.12.2) and vscode-icons-team.vscode-icons (12.19.0). Cursor installed exactly these Open VSX latest versions.
  • Some Microsoft extensions (ms-vscode.cpptools, cpptools-extension-pack, ms-python.vscode-pylance) are absent from Open VSX. Cursor serves a first-party Anysphere replacement for Pylance (v1.0.12) under the same ID. This is intentional, but name-based lookup cannot distinguish it from a malicious namesake.
  • Three abuse paths are outlined. The first is unclaimed names: extensions recommended by Cursor and Antigravity were missing from Open VSX, so anyone could register them. Koi Security's Oren Yomtov reported this in late November 2025, Cursor fixed it on 1 December 2025, Antigravity followed in late December, and Koi registered six placeholder names. The second is a different owner registering the same name. The third is a legitimate publisher pushing a malicious version, as the DarkGPT extensions did on Microsoft's marketplace with a signed Windows program, a hijacked DLL and a downloader in a hidden PowerShell window.
  • Background: in 2025 Koi Security found a flaw that exposed Open VSX's publishing bot token, which could have allowed pushing new versions of any extension. It was reported in May 2025 and fixed in June 2025.
  • Extensions can read files and run programs, giving access to source code, cloud keys and SSH keys. Extension auto update (extensions.autoUpdate) is enabled by default in VS Code and Cursor.

Remediation

  • Install pinned versions with cursor --install-extension <publisher>.<name>@<version> and keep auto update off if updates are actually reviewed.
  • After any import, compare cursor --list-extensions --show-versions with the list from the previous editor and check every swap and missing entry.
  • Set extensions.installCooldownHours (team owners can set Marketplace Install Cooldown) so new versions wait before installation.
  • Verify the publisher in the store the editor actually reads, e.g. publishedBy in https://open-vsx.org/api/<namespace>/<name>/latest.
  • On team plans, enforce an allowlist of publishers or extension names via the team dashboard or the AllowedExtensions device management policy.

Linha do tempo

  1. safedep.io ↗ · pub. 11/09/2026 07:00 · coletado 19/10 18:03 primeiro registro

    Cursor's VS Code import installs latest Open VSX extension versions, exposing agentic IDE users to supply chain risk

    ler a análise desta fonte

    SafeDep research shows that Cursor's Import VS Code Configuration step copies only the publisher.extension_name of each installed extension and drops the version. Cursor then installs whatever version Open VSX (run by the Eclipse Foundation) calls latest, through its proxy marketplace.cursorapi.com. In SafeDep's test, three extensions pinned at old versions all came back at the Open VSX latest version. Because identical extension IDs can map to different publishers or code on Open VSX and the Microsoft Marketplace, and because auto update is on by default, the behavior widens the extension supply chain attack surface for developers on VS Code forks (Cursor, Windsurf, Google Antigravity). The article describes a risk and misconfiguration pattern, not a confirmed active campaign against Cursor users.

    Technical Details

    • Cursor routes extension search and downloads through its own proxy. Open VSX-sourced files carry /open-vsx-mirror/ in the URL, while the few Cursor-hosted ones use /downloads/production/. Cursor's automated malware and supply chain checks can block an extension but do not influence which version is served.
    • Tested extensions: esbenp.prettier-vscode (12.4.0), formulahendry.code-runner (0.12.2) and vscode-icons-team.vscode-icons (12.19.0). Cursor installed exactly these Open VSX latest versions.
    • Some Microsoft extensions (ms-vscode.cpptools, cpptools-extension-pack, ms-python.vscode-pylance) are absent from Open VSX. Cursor serves a first-party Anysphere replacement for Pylance (v1.0.12) under the same ID. This is intentional, but name-based lookup cannot distinguish it from a malicious namesake.
    • Three abuse paths are outlined. The first is unclaimed names: extensions recommended by Cursor and Antigravity were missing from Open VSX, so anyone could register them. Koi Security's Oren Yomtov reported this in late November 2025, Cursor fixed it on 1 December 2025, Antigravity followed in late December, and Koi registered six placeholder names. The second is a different owner registering the same name. The third is a legitimate publisher pushing a malicious version, as the DarkGPT extensions did on Microsoft's marketplace with a signed Windows program, a hijacked DLL and a downloader in a hidden PowerShell window.
    • Background: in 2025 Koi Security found a flaw that exposed Open VSX's publishing bot token, which could have allowed pushing new versions of any extension. It was reported in May 2025 and fixed in June 2025.
    • Extensions can read files and run programs, giving access to source code, cloud keys and SSH keys. Extension auto update (extensions.autoUpdate) is enabled by default in VS Code and Cursor.

    Remediation

    • Install pinned versions with cursor --install-extension <publisher>.<name>@<version> and keep auto update off if updates are actually reviewed.
    • After any import, compare cursor --list-extensions --show-versions with the list from the previous editor and check every swap and missing entry.
    • Set extensions.installCooldownHours (team owners can set Marketplace Install Cooldown) so new versions wait before installation.
    • Verify the publisher in the store the editor actually reads, e.g. publishedBy in https://open-vsx.org/api/<namespace>/<name>/latest.
    • On team plans, enforce an allowlist of publishers or extension names via the team dashboard or the AllowedExtensions device management policy.