What to check before you install a Cursor plugin or extension

Direct answer

Before you install a Cursor plugin or extension, check who publishes it, whether Cursor’s own plugin list carries it, whether Open VSX, VS Marketplace and Cursor served the same build for the version you are about to get, whether an advisory names it, and what it runs once installed.

Five checks

  1. Check 1

    Know who publishes it

    Cursor installs editor extensions from Open VSX and plugins from its Marketplace. A publisher name on one store is not proof of the same publisher on another.

  2. Check 2

    Check whether Cursor lists it

    HOL reads the plugins Cursor publishes itself. Cursor does not publish its list of third-party Marketplace plugins, so for those HOL can say nothing about acceptance.

  3. Check 3

    Compare builds across stores

    HOL records the digest each store served for each extension version and whether it was signed. Different digests for the same version, or a version withdrawn on one store, show as events.

  4. Check 4

    Check advisories

    When two public sources describe an incident affecting an extension, HOL publishes an advisory naming the versions and the stores that served them.

  5. Check 5

    Read what it runs

    Extensions run with your editor’s access to files, terminals and network. Read the listing’s scan and the extension’s declared activation events before you install.

What HOL recorded for Cursor

Counted when this page loaded, from HOL’s directory reads and release ledger. Each listing page shows the same records for one plugin.

Directories HOL reads for Cursor

Partial list

Cursor official plugins

Read on : 128 entries, 0 of them matched to HOL listings.

Release records

In the last 30 days HOL recorded builds for 25 plugins on the channels Cursor installs from, and noted 0 integrity events.

Advisories

Limitations

  • A directory listing, a matching build and a clean scan are records of what HOL saw. None of them says a plugin is harmless.
  • HOL compares what each channel served; it does not say which channel is right or why a build changed.
  • Advisories appear only when two public sources describe the incident.
  • Cursor’s third-party Marketplace list is not public, so acceptance covers Cursor’s own plugins only.

For publishers

Every record on this page is public and free. Listing owners can subscribe to a webhook for integrity events on their listing; with HOL Blue or Gold it arrives within minutes instead of in a weekly digest, so owners hear about a change before their users do. What a publisher pays never changes what HOL records or shows here.

Run the free directory pre-flight · Release integrity