{"slug": "the-agentic-ide-extension-blind-spot", "title": "The Agentic IDE Extension Blind Spot", "summary": "Cursor's \"Import VS Code Configuration\" feature copies only extension names, not versions, from Visual Studio Code, so the agentic IDE installs whatever version Open VSX labels newest, according to a report on the extension supply-chain blind spot. Because Microsoft's terms bar VS Code forks from its marketplace, Cursor routes extension downloads through its own proxy (marketplace.cursorapi.com) to Open VSX, the Eclipse Foundation registry, where the same publisher.extension name can point to different publishers or code. The report notes that in 2025 Koi Security found a way to steal Open VSX's bot publishing token, which was reported in May 2025 and fixed in June, and advises users to pin versions with `cursor --install-extension <publisher>.<name>@<version>` and disable auto update.", "body_md": "On this page\n\nDid you move from Visual Studio Code to one of the new editors like Cursor, Windsurf or Google Antigravity? Ever wondered what happens to all your Visual Studio Code extensions? They seem to work fine in your new agentic IDE.\n\nMicrosoft’s terms do not let Visual Studio Code forks use its marketplace. So they use\n[Open VSX](https://open-vsx.org/) instead, a registry run by the Eclipse Foundation. But nobody\nguarantees that the two carry the same extensions, or the same versions. That is where things get\nmessy.\n\nTwo stores and the same extension names, with no verification that the publisher is the same. That is a supply chain attack waiting to happen.\n\n## Summary\n\nCursor’s **Import VS Code Configuration** step sends only the extension name, never the version you\nwere running. So Cursor installs the newest version Open VSX has. We held three extensions at old\nversions and ran the import. All three came back at the version Open VSX calls newest. To keep the\nversion you want, name it yourself with `cursor --install-extension <publisher>.<name>@<version>`.\nMake sure you have auto update off.\n\n## The problem\n\nCursor can install all the same extensions you had in Visual Studio Code, but not the same versions. An extension can arrive newer than the one you were using, older, or not at all.\n\nThe first time you open Cursor it offers to copy your Visual Studio Code setup across. Cursor calls\nthis **Import VS Code Configuration**, and you can run it again later from Cursor’s settings. It\nbrings over your extensions, settings, keybindings and workspace history, and it replaces what\nCursor already had.\n\nThe import reads your Visual Studio Code extension list and copies only the name of each one. The\nformat is `publisher.extension_name`, for example `ms-python.python`. It does not have a version\nattached to it.\n\nSo Cursor has nothing to match against. It searches its own extension store for that name and installs the newest version it has there. For most extensions that store just forwards your request to Open VSX, so you end up on whatever Open VSX calls latest.\n\nA store you never chose decided which version you get. That extension can read your files and run programs on your machine.\n\n## The two extension stores\n\nCursor is built on Visual Studio Code, but it cannot use Microsoft’s extension store. Microsoft’s\nrules do not let copies of the editor use it. So Cursor uses a different store,\n[Open VSX](https://open-vsx.org/), and goes through its own server to get there. From Cursor’s\n[extensions page](https://cursor.com/help/customization/extensions):\n\nCursor routes extension search and downloads through its own marketplace proxy\n(`marketplace.cursorapi.com`).\n\nBoth stores name extensions the same way. A name does not tell you who owns it, or which store it came from. So the same name can mean different code in each store. Cursor says this in plain words on the same page:\n\nThe same `publisher.extension` name can point to different publishers or code on Open VSX than on\nthe Microsoft Marketplace. Treat extension IDs like dependencies: install from publishers you\ntrust.\n\nAsk all three places for the same three names and you get three different answers.\n\nCursor’s store does not keep most extensions itself. It fetches them from Open VSX, runs its own checks on them, and then serves you the copy Open VSX had. The checks can block an extension, but they do not change which version you get. That part is still Open VSX’s call.\n\nThe download links Cursor gives out show which extensions work this way. Ones that come from Open\nVSX have `/open-vsx-mirror/` in the link. The few that Cursor keeps itself have\n`/downloads/production/` instead.\n\nOpen VSX uploads many of its extensions through a bot account of its own instead of the author’s\naccount. In 2025, Koi Security found a way to steal that account’s publishing token. Whoever held it could\nhave pushed a new version of any extension in the store. It was\n[reported in May 2025 and fixed in June 2025](https://www.securityweek.com/vulnerability-exposed-all-open-vsx-repositories-to-takeover/).\n\n## What the import sends\n\nCursor’s own help text shows what the install command takes.\n\nYou can ask for a version. You add `@` and the number. The import never does that. It sends the name\nand takes whatever comes back.\n\n## How to check it yourself\n\nInstall a few extensions in Visual Studio Code and hold them at old versions on purpose. Then open\nCursor and run **Import VS Code Configuration**. List them again in Cursor afterwards. Turn off\nCursor’s extension auto update first, so auto update is not the reason anything changed.\n\nAll three moved. Now ask Open VSX what it calls latest for those same three names.\n\nThose are the exact versions Cursor installed. You can also do one extension at a time, without the full import.\n\n## What changed\n\n| Extension | Visual Studio Code | Cursor after import | Open VSX latest | \n|---|---|---|---|\n| `esbenp.prettier-vscode` | 12.1.0 | 12.4.0 | 12.4.0 | \n| `formulahendry.code-runner` | 0.12.0 | 0.12.2 | 0.12.2 | \n| `vscode-icons-team.vscode-icons` | 12.17.0 | 12.19.0 | 12.19.0 | \n\nAll three landed on exactly the version Open VSX calls latest, and the version you were running never came into it.\n\nOne extra line showed up in Cursor that was never in Visual Studio Code:\n[\\[email protected\\]](/cdn-cgi/l/email-protection)\n\nSome extensions never make it into Cursor. Microsoft keeps a few of its own, such as the C/C++ extension and Pylance, available only in its own store. Open VSX does not have them, so there is nothing for Cursor to fetch.\n\nPylance is the odd one. Microsoft’s store gives you `ms-python.vscode-pylance` from the publisher\n`ms-python`, checked as `microsoft.com`. Ask Cursor’s server for that same name and you get the\npublisher `anysphere` at version 1.0.12. Anysphere is the company that builds Cursor. This is on\npurpose, and Cursor’s help page says so:\n\nCursor publishes first-party **Anysphere** replacements for some widely used extensions that are\nunavailable on Open VSX.\n\nIt is still the clearest example of how all this works. One name, and a different company’s code behind it. Here the swap is on purpose, and it is safe. But the search that finds it cannot tell that apart from some random person grabbing the same name.\n\n## How this can go wrong\n\nThere are three ways this goes bad.\n\n**A name nobody has taken.** Cursor recommends extensions when you open a project. Some of those\nextensions were never published to Open VSX, so the name remained unclaimed and anyone could\nregister it. Koi Security researcher Oren Yomtov reported it in late November 2025. Cursor fixed it\non 1 December 2025, and Google Antigravity followed in late December. Koi grabbed six of the free\nnames themselves, with empty extensions, to keep attackers away from them. The Hacker News wrote\nabout it in\n[VS Code Forks Recommend Missing Extensions](https://thehackernews.com/2026/01/vs-code-forks-recommend-missing.html).\n\n**Someone else owning the same name.** This is the Pylance case, minus the part where the company\ndoing it is one you already trust. A name does not tie back to whoever owns it in Microsoft’s store.\n\n**A good publisher pushing a bad version.** This one is the hardest to catch, because the name, the\nowner and the store all look right. The [DarkGPT extensions](/dark-gpt-vscode-malicious-extension)\ndid this on Microsoft’s store. They used a signed Windows program and a hijacked DLL to run a\ndownloader in a hidden PowerShell window.\n\nAn extension can read your files, start programs, and get at your source code, your cloud keys and your SSH keys. One machine is enough to put the rest of the team at risk.\n\n## Auto update makes it worse\n\nExtension auto update is on by default in Visual Studio Code, under `extensions.autoUpdate`, and\nCursor keeps that default. Auto update is good, because it gets security fixes to you fast. So\nturning it off costs you something real. But it also means new code runs before anyone has looked at\nit. It is the same problem as not pinning a version in a GitHub Actions workflow. If someone steals\na publisher’s account, auto update ships their code to everybody.\n\n## What to do\n\nCursor does check extensions, and it is worth knowing what those checks cover. It runs automated malware and supply chain analysis on its own server before an extension shows up in search or gets served as a download. Extensions that fail are blocked, and Cursor updates that blocklist from extension threat intelligence. Publishers marked as verified have had their identity confirmed. Malicious extensions have got past checks like these before, so treat them as filters and not as a wall.\n\n- Ask for the version you want. `cursor --install-extension <publisher>.<name>@<version>` installs\nthat exact one. Make sure you have auto update off. Write those down where the team can see them,\nthe same way you share a lockfile.\n- After any import, run `cursor --list-extensions --show-versions` and compare it with the same list\nfrom the editor you left. Check every swap and every missing row. Do not assume the import copied\nwhat you had.\n- Make new versions wait before they can be installed. Cursor has a setting for it,\n`extensions.installCooldownHours` , and team owners can set**Marketplace Install Cooldown\n(hours)** for everyone.\n- Check the publisher in the store your editor actually reads, not on the Microsoft page you\nremember. For Open VSX, `https://open-vsx.org/api/<namespace>/<name>/latest` shows`publishedBy` ,\nwhich is who uploaded it.\n- Turn auto update off if someone will really check the updates. The downside is that known bad versions stay on your machine longer. If nobody has time to check, a waiting period is the better default.\n- On a team plan, limit installs to a list you approve. Cursor takes an allowlist of publishers or\nextension names from the team dashboard, or through device management as `AllowedExtensions` .\n\nAn extension name works like a package name. Your editor looks it up when it installs, in a store\nyou did not pick. The [files AI coding agents read](/miasma-worm-ai-coding-agent-config-injection)\nare already being attacked. Extensions need the same care you give a lockfile.\n\n## References\n\n- Cursor documentation, Extensions: [https://cursor.com/help/customization/extensions](https://cursor.com/help/customization/extensions)\n- Open VSX Registry: [https://open-vsx.org/](https://open-vsx.org/)\n- Open VSX registry takeover, SecurityWeek: [https://www.securityweek.com/vulnerability-exposed-all-open-vsx-repositories-to-takeover/](https://www.securityweek.com/vulnerability-exposed-all-open-vsx-repositories-to-takeover/)\n- VS Code forks recommend missing extensions, The Hacker News: [https://thehackernews.com/2026/01/vs-code-forks-recommend-missing.html](https://thehackernews.com/2026/01/vs-code-forks-recommend-missing.html)\n- VS Code forks expose users to recommended extension attacks, BleepingComputer: [https://www.bleepingcomputer.com/news/security/vscode-ide-forks-expose-users-to-recommended-extension-attacks/](https://www.bleepingcomputer.com/news/security/vscode-ide-forks-expose-users-to-recommended-extension-attacks/)\n- Visual Studio Marketplace Terms of Use: [https://cdn.vsassets.io/v/M190_20210811.1/_content/Microsoft-Visual-Studio-Marketplace-Terms-of-Use.pdf](https://cdn.vsassets.io/v/M190_20210811.1/_content/Microsoft-Visual-Studio-Marketplace-Terms-of-Use.pdf)\n- Mazin Ahmed on publishing malicious Visual Studio Code extensions: [https://mazinahmed.net/blog/publishing-malicious-vscode-extensions](https://mazinahmed.net/blog/publishing-malicious-vscode-extensions)\n\n- cursor\n- vscode\n- open-vsx\n- supply-chain\n- ai-coding-agents\n\n### Author\n\n#### Vignesh Naikoti\n\nsafedep.io\n\n### Share\n\n## The Latest from SafeDep blogs\n\nFollow for the latest updates and insights on open source security & engineering\n\n   \n\n##   [Deep-Live-Cam Supply Chain Attack: Technical Analysis](/deep-live-cam-supply-chain-attack)  \n\n A malicious dependency in Deep-Live-Cam loads a clipboard hijacker. We trace the installation trigger, Telegraph delivery, and Windows and macOS persistence.\n\n   \n\n##   [A malicious npm package hidden three dependencies deep: the ulid-xyz delivery chain](/ulid-xyz-transitive-dependency-delivery-chain)  \n\n ulid-xyz is a remote access trojan we reported to OSV as MAL-2026-6672. It reached developers as a third-level transitive dependency of ioredis-xyz, a copy of the real Redis client planted in 28...\n\n   \n\n##   [Introducing SafeDep Threat Intel](/introducing-safedep-threat-intel)  \n\n SafeDep Threat Intel gives SOC and cyber defense teams the malicious package intelligence behind SafeDep's platform, to query or to push into the tools they already run.\n\n   \n\n##   [Mini Shai-Hulud Strikes Again: openapi-react-query-codegen](/mini-shai-hulud-openapi-react-query-codegen-compromised)  \n\n An attacker exploited a flawed GitHub Actions workflow to publish 10 malicious versions of @7nohe/openapi-react-query-codegen (671K downloads/month) via npm OIDC trusted publishing. The payload uses...\n\n## Ship Code.\n\n## Not Malware.\n\nStart free with open source tools on your machine. Scale to a unified platform for your organization.", "url": "https://wpnews.pro/news/the-agentic-ide-extension-blind-spot", "canonical_source": "https://safedep.io/cursor-extension-import-versions", "published_at": "2026-09-11 10:00:00+00:00", "updated_at": "2026-09-11 11:40:08.294001+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-products"], "entities": ["Cursor", "Visual Studio Code", "Open VSX", "Eclipse Foundation", "Microsoft", "Google Antigravity", "Windsurf", "Koi Security"], "alternates": {"html": "https://wpnews.pro/news/the-agentic-ide-extension-blind-spot", "markdown": "https://wpnews.pro/news/the-agentic-ide-extension-blind-spot.md", "text": "https://wpnews.pro/news/the-agentic-ide-extension-blind-spot.txt", "jsonld": "https://wpnews.pro/news/the-agentic-ide-extension-blind-spot.jsonld"}}