[bostik]

Local DNS override, and two registries. One mirroring the relevant public NPM packages as they are, and one "normal" internal one. Make the mirror registry resolvable with the same name(s) as the real, public NPM registry.

Then test the behaviour.

[mmsc]

I think there's an incorrect assumption that the Snyk team has any access to Cursor's systems, or their source code.