@cursor/july@0.1.105: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@cursor/july@0.1.105: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/channels/slack/eval-directive.jsView file

134} L135: const lines = [`*${evals.length} eval(s):*`]; L136: for (const item of evals) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/channels/slack/eval-directive.jsView on unpkg · L134

dist/internal/authored-loaders.jsView file

44* L45: * Node caches `import()` by URL for the life of the process, so a long-lived L46: * `agent-sdk dev` would otherwise keep serving the first load of eval files

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/internal/authored-loaders.jsView on unpkg · L44

dist/channels.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 17

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels.jsView on unpkg

dist/internal/init-project.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cursor/july@0.1.104 matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.104 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/internal/init-project.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 258-298json

258 "import": "./dist/storage-backends/cursor-hosted.js",

259 "default": "./dist/storage-backends/cursor-hosted.js"

260 },

261 "./otel": {

262 "anysphere-source": "./src/otel.ts",

263 "types": "./dist/otel.d.ts",

264 "import": "./dist/otel.js",

265 "default": "./dist/otel.js"

266 },

267 "./package.json": {

268 "anysphere-source": "./package.json",

269 "bun": "./package.json",

270 "types": "./package.json",

271 "import": "./package.json",

272 "default": "./package.json"

273 }

274 },

275 "scripts": {

276 "build": "tsgo -p tsconfig.build.json && node scripts/bundle-publish-shims.mjs && node scripts/copy-extension-assets.mjs && pnpm run build:playground && pnpm run docs:build",

277 "build:dist": "node scripts/build-hosted-dist.mjs",

278 "postinstall": "node -e \"try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L278

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L278

279 "build:playground": "vite build --config playground/vite.config.ts",

280 "build:playground:central": "vite build --mode central --config playground/vite.config.ts",

281 "dev:playground": "vite --config playground/vite.config.ts",

282 "check": "biome check src && tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",

283 "docs:dev": "vitepress dev docs",

284 "docs:build": "vitepress build docs",

285 "docs:preview": "vitepress preview docs",

286 "docs:verify-links": "node scripts/verify-docs-links.mjs",

287 "fix": "biome check --write --unsafe src",

288 "test": "vitest run --passWithNoTests",

289 "type-check": "tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",

290 "build-dev": "echo noop",

291 "build-types": "tsgo -p tsconfig.build.json --emitDeclarationOnly",

292 "verify-publish": "node scripts/verify-publish-artifacts.mjs",

293 "smoke-publish": "node scripts/smoke-publish-artifact.mjs",

294 "publish-check": "pnpm run build && pnpm run verify-publish && pnpm run smoke-publish"

295 },

296 "engines": {

297 "node": ">=22.13"

298 },

dist/channels/slack/eval-directive.jsView file

Lines 114-154javascript

114/** True when either raw Slack text or markdown form is an eval directive. */

115export function isSlackEvalDirective(text, markdown) {

116 return (parseSlackEvalDirective(text) !== null ||

117

dist/internal/authored-loaders.jsView file

Lines 24-64javascript

24 function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }

25 function step(result) { result.done ?

dist/channels.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 17

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels.jsView on unpkg

dist/internal/init-project.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cursor/july@0.1.104 matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.104 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/internal/init-project.jsView on unpkg