How do you check a package before installing it in Cursor?

Install the Safeguard extension in Cursor, then add the package to your manifest and read the inline warning before you run any install command. The docs say the extension flags typosquats, dependency confusion and known malicious names as you type, but it checks names and does not intercept a real install.

How do you install the extension in Cursor?

The Safeguard IDE Support page says Cursor installs through Open VSX rather than the VS Code Marketplace. VS Code and Cursor use the same extension. From a terminal:

cursor --install-extension Safeguard-sh-Inc.SafeguardshIdeExtension

You can also search for "Safeguard" in the Extensions view and click Install. The docs list VS Code 1.85.0 or later as the requirement for the extension. In VS Code the equivalent command starts with code.

What do you see after installing?

A Safeguard view appears in the activity bar with four panels: Vulnerabilities, SBOM, Compliance and Recommendations. Hovering a flagged dependency gives a summary and a lightbulb fix, and reports can be exported.

How does the pre install check work?

The IDE page describes inline Package Firewall checks for VS Code and Cursor. As you edit a manifest such as package.json, the extension checks each dependency you add and flags:

• typosquats, meaning names that resemble well known packages
• dependency confusion, meaning names that could resolve to a public package instead of an internal one
• known malicious packages

The docs say this happens before you ever run install. They also state the limits plainly: it evaluates package names as you type and does not intercept a real install. The install time proxy is a separate feature described on the Package Firewall page, which covers npm and pip. The JetBrains plugin documentation does not mention the inline check.

So the order is simple. Add the name, look at the squiggle, then decide. If the editor says the name looks like a typosquat of a package you know, compare the spelling with the registry page before going further.

What does the check not do?

Be clear about the gaps, because a green editor is not a safety guarantee.

• It does not stop someone running npm install in a terminal outside the editor. Use the proxy described on the Package Firewall page for that, if your admin enables it.
• A name check cannot judge a legitimate package that later turns malicious. The Package Firewall page lists behavioral analysis of package archives, but that belongs to the proxy, not to the inline check.
• It covers what you type. Transitive dependencies arrive through the install step, which is where the proxy sits.

See it in action at /demos/gate-dev-ide.

What if the AI assistant suggests the package?

Cursor's assistant may suggest a dependency with a plausible name. Treat that as an untrusted source, the same as a forum answer. Add the line to the manifest and let the extension look at it before you accept the change. If it flags a name, check that the package exists, who maintains it and when it was published.

What to do

1. Run the install command above, or search for the extension in Open VSX within Cursor.
2. Sign in and open the Safeguard view in the activity bar.
3. Add a harmless test dependency with a deliberately misspelled popular name in a scratch project, and confirm you see a flag.
4. Remove the test line.
5. For every real new dependency, open its registry page and check maintainer, release date and download history.
6. Ask your admin whether the Package Firewall proxy is enabled for your terminals and CI.
7. Treat any assistant suggested package as unverified until the check passes.

Quick check

Sources

• Safeguard docs: IDE Support, fetched 18 October 2026
• Safeguard docs: Package Firewall, fetched 18 October 2026

Last reviewed: 18 October 2026.