Install Socket for Origin to Scan Pull Requests for Dependency Risks

Socket has released a new integration for Cursor’s Origin platform that automatically scans software dependencies for security risks. This update allows development teams to identify potentially malicious packages or compromised updates directly within their pull requests before merging code. The tool is now available for installation through the Origin App Marketplace.

In plain English

When developers build applications, they often use code libraries created by others. These external pieces of code are called dependencies. If a dependency contains hidden malicious behavior or has been compromised by attackers, it can endanger the entire application. Socket analyzes these open-source packages to detect supply chain risks. It provides reviewers with context about the safety of the packages being added to the project.

The background

Origin was built by SpaceXSI to host and collaborate on code at a scale that traditional Git infrastructure was not designed to handle. It brings repository hosting, pull requests, and coding agents into Cursor’s development workflow. Whether a human developer adds a package or an AI agent selects one while implementing a feature, that dependency becomes part of the software supply chain. Reviewing the application code alone does not reveal whether the external dependencies are safe.

What changes now

Socket for Origin is now available in the Origin App Marketplace, joining more than 20 other developer tools. Teams can use Socket alongside their existing continuous integration, deployment, and code review tools. Once connected, Socket scans supported manifests and lockfiles when a pull request is opened or new commits are pushed. This includes dependency changes in monorepo workspaces. The tool compares the target branch with the proposed merge result to evaluate the changes.

The integration provides a policy-based security check that shows scan progress and reports a verdict based on the organization’s policies. Developers can rerun the check directly in Origin. Socket also posts pull request comments with dependency overviews, scores, severity labels, and links to full reports. Subsequent scan results update the comments as the pull request changes. Reviewers can see findings without leaving the pull request.

Key terms explained

Teams usually configure policies that define acceptable risk levels for software components. Check whether your organization has established rules for evaluating third-party code libraries. Reviewers often rely on automated scans to flag unusual behavior in dependencies. Verify that your workflow includes steps to assess the safety of external packages before merging. Ensure that security findings are visible to all team members involved in code reviews.

Background: Supply chain attacks

Supply chain attacks compromise your systems indirectly. An adversary infiltrates a trusted vendor or software update. When you install that legitimate-looking update, the malware executes inside your network. This method bypasses perimeter defenses because the code carries a valid digital signature from a reputable source.

Read the full guide: What Is Supply Chain Attacks: How Indirect Compromise Works

What to do and how to stay safe: Socket

• Install Socket from the Origin App Marketplace and authorize your organization to enable automatic scanning.
• Review the dependency summaries and security findings posted as comments on your pull requests.
• Check the full Socket report for detailed context when a package is flagged for potential risks.
• Ensure your team’s policies are configured to align with your security requirements for dependency checks.

General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does Socket for Origin scan code changes or just dependencies?

Socket scans dependency changes in pull requests, analyzing open-source packages for malicious behavior and supply chain risks.

How does Socket integrate with the Origin workflow?

It posts security findings, scores, and severity labels directly on pull requests as comments for reviewers to see.

Can developers rerun the security scan if needed?

Yes, developers can rerun the Socket Security / Dependency scan check directly within Origin.