Socket Adds Dependency Scanning to Cursor’s Origin App Marketplace

Socket has released Socket for Origin, a new integration that adds automated dependency scanning to pull requests within Cursor’s development environment. The tool is now available for installation through the Origin App Marketplace, allowing teams to incorporate supply chain security checks directly into their code review processes.

The integration automatically scans supported manifests and lockfiles whenever a pull request is opened or new commits are pushed. It compares the target branch against the proposed merge result to evaluate any dependency changes, including those in monorepo workspaces, and reports findings based on the organization’s specific security policies.

Context and Background

SpaceXSI built Origin to provide developers and AI agents with a platform for hosting and collaborating on code at scales that traditional Git infrastructure was not designed to handle. According to Socket, Origin integrates repository hosting, pull requests, and coding agents into Cursor’s workflow, creating a unified environment for software development.

Socket states that its addition to the marketplace joins more than twenty other developer tools. This allows teams building on Origin to use Socket alongside their existing continuous integration, deployment, and code review utilities, maintaining a cohesive toolchain while adding a layer of dependency security.

Who Is Affected

Any team using Cursor and Origin for development is affected by this release, particularly those managing software supply chains that include open source packages. Whether a human developer adds a package or an AI agent selects one during feature implementation, that dependency becomes part of the application’s supply chain.

Socket notes that a small change to a manifest or lockfile can introduce malicious packages or compromised updates. Reviewing application code alone does not reveal whether the dependencies it pulls in are safe, making automated analysis of these external components critical for maintaining security before merging code.

What should you do?

Reviewers can now see dependency findings without leaving the pull request interface. Socket posts comments with dependency overviews, scores, severity labels, and links to full reports. These comments update automatically as the pull request changes, ensuring that reviewers have the most current security context before approving merges.

To utilize this feature, teams must install Socket from the Origin App Marketplace, authorize their Socket organization, and confirm the connection. Once configured, scans run automatically as pull requests are opened and commits are pushed, providing continuous visibility into dependency risks.

What to do and how to stay safe: Socket

• Install Socket for Origin from the marketplace and authorize your organization to enable automatic scanning of pull requests.
• Review the policy-based security checks and PR comments posted by Socket to identify flagged dependencies before merging code.
• Configure your organization’s security policies within Socket to ensure scans align with your team’s risk tolerance and compliance requirements.
• Monitor subsequent scan results as pull requests change to ensure new commits do not introduce additional supply chain risks.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What does Socket for Origin do?

It scans dependency changes in pull requests and flags security risks based on your team’s policies, providing findings directly within the Origin interface.

Where can I install Socket for Origin?

It is available for installation in the Origin App Marketplace, which is part of Cursor’s development workflow.

Does it scan manually added packages?

Yes, it scans supported manifests and lockfiles when pull requests are opened or commits are pushed, covering both developer-added and agent-selected dependencies.