@cursor/july@0.1.109: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@cursor/july@0.1.109: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•matchType = token_shingles matchedPackage = @cursor/july@0.1.107 matchedPath = package.json matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

package.jsonView on unpkg

dist/channels/slack/eval-directive.jsView file

134} L135: const lines = [`*${evals.length} eval(s):*`]; L136: for (const item of evals) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/channels/slack/eval-directive.jsView on unpkg · L134

dist/internal/authored-loaders.jsView file

45* L46: * Node caches `import()` by URL for the life of the process, so a long-lived L47: * `agent-sdk dev` would otherwise keep serving the first load of eval files

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/internal/authored-loaders.jsView on unpkg · L45

dist/channels.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 16

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels.jsView on unpkg

dist/internal/mcp-oauth.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/mcp-oauth.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/mcp-oauth.jsView on unpkg

dist/internal/playground/toolchain.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = [redacted].js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/playground/toolchain.jsView on unpkg

dist/internal/update-check.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/update-check.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/update-check.jsView on unpkg

dist/internal/cli-github.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/cli-github.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/cli-github.jsView on unpkg

dist/internal/cli-slack-manual.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/cli-slack-manual.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/cli-slack-manual.jsView on unpkg

dist/internal/docs-site.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/docs-site.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/docs-site.jsView on unpkg

dist/internal/init-project.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/init-project.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/init-project.jsView on unpkg

dist/internal/open-browser.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/open-browser.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/open-browser.jsView on unpkg

dist/channels/github/auth.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/channels/github/auth.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/channels/github/auth.jsView on unpkg

dist/internal/deploy-source.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/deploy-source.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/deploy-source.jsView on unpkg

dist/channels/origin/origin-webhook.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/channels/origin/origin-webhook.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/channels/origin/origin-webhook.jsView on unpkg