Loading npm security reports…

@cursor/july@0.1.107: AI-agent control-surface risk | LPM Firewall

registry / @cursor/july / 0.1.107

@cursor/july@0.1.107

(early alpha) Filesystem-first framework for defining Cursor agents as markdown and TypeScript and serving them over channels with the Cursor SDK.

AI Security Review

scanned 28d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically changes the user's global Cursor AI instruction surface. It copies and rewrites skills so they are applied globally, and deletes selected prior skill folders.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install or npx installation of the package

Impact

Package content can influence Cursor agent behavior across projects without an interactive consent step.

Mechanism

Postinstall writes global always-applied Cursor skills

Policy narrative

The registry install lifecycle launches the package installer automatically. For consumer installs, it writes shipped skills beneath the user's global Cursor configuration, overwrites package-managed copies, rewrites their front matter to make them always apply, and removes stale or legacy skill directories. This is an unconsented postinstall mutation of a broad AI-agent control surface.

AI rationale

The automatic lifecycle hook modifies a global Cursor instruction directory and activates installed instructions globally. This satisfies the install-hook policy for a broad AI-agent control-surface mutation despite the opt-out and absence of network activity.

Evidence

package.jsonscripts/install-cursor-skills.mjsdist/internal/install-cursor-skills.js~/.cursor/skills/agentsdk/~/.cursor/skills/agentkit/

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/channels/slack/eval-directive.jsView file

134} L135: const lines = [`*${evals.length} eval(s):*`]; L136: for (const item of evals) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/channels/slack/eval-directive.jsView on unpkg · L134

dist/internal/authored-loaders.jsView file

44* L45: * Node caches `import()` by URL for the life of the process, so a long-lived L46: * `agent-sdk dev` would otherwise keep serving the first load of eval files

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/internal/authored-loaders.jsView on unpkg · L44

dist/channels.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 17

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels.jsView on unpkg

dist/bin/agent-serve.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cursor/july@0.1.105 matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.105 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/agent-serve.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 258-298json

258 "import": "./dist/storage-backends/cursor-hosted.js",

259 "default": "./dist/storage-backends/cursor-hosted.js"

260 },

261 "./otel": {

262 "anysphere-source": "./src/otel.ts",

263 "types": "./dist/otel.d.ts",

264 "import": "./dist/otel.js",

265 "default": "./dist/otel.js"

266 },

267 "./package.json": {

268 "anysphere-source": "./package.json",

269 "bun": "./package.json",

270 "types": "./package.json",

271 "import": "./package.json",

272 "default": "./package.json"

273 }

274 },

275 "scripts": {

276 "build": "tsgo -p tsconfig.build.json && node scripts/bundle-publish-shims.mjs && node scripts/copy-extension-assets.mjs && pnpm run build:playground && pnpm run docs:build",

277 "build:dist": "node scripts/build-hosted-dist.mjs",

278 "postinstall": "node -e \"try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L278

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L278

279 "build:playground": "vite build --config playground/vite.config.ts",

280 "build:playground:central": "vite build --mode central --config playground/vite.config.ts",

281 "dev:playground": "vite --config playground/vite.config.ts",

282 "check": "biome check src && tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",

283 "docs:dev": "vitepress dev docs",

284 "docs:build": "vitepress build docs",

285 "docs:preview": "vitepress preview docs",

286 "docs:verify-links": "node scripts/verify-docs-links.mjs",

287 "fix": "biome check --write --unsafe src",

288 "test": "vitest run --passWithNoTests",

289 "type-check": "tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",

290 "build-dev": "echo noop",

291 "build-types": "tsgo -p tsconfig.build.json --emitDeclarationOnly",

292 "verify-publish": "node scripts/verify-publish-artifacts.mjs",

293 "smoke-publish": "node scripts/smoke-publish-artifact.mjs",

294 "publish-check": "pnpm run build && pnpm run verify-publish && pnpm run smoke-publish"

295 },

296 "engines": {

297 "node": ">=22.13"

298 },

dist/channels/slack/eval-directive.jsView file

Lines 114-154javascript

114/** True when either raw Slack text or markdown form is an eval directive. */

115export function isSlackEvalDirective(text, markdown) {

116 return (parseSlackEvalDirective(text) !== null ||

117

dist/internal/authored-loaders.jsView file

Lines 24-64javascript

24 function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }

25 function step(result) { result.done ?

dist/channels.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 17

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels.jsView on unpkg

dist/bin/agent-serve.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cursor/july@0.1.105 matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.105 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/agent-serve.jsView on unpkg