@cursor/july@0.1.111: Unknown npm security report (Allow) | LPM Firewall

Loading npm security reports…

@cursor/july@0.1.111: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•matchType = token_shingles matchedPackage = @cursor/july@0.1.107 matchedPath = package.json matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

package.jsonView on unpkg

dist/internal/authored-loaders.jsView file

45* L46: * Node caches `import()` by URL for the life of the process, so a long-lived L47: * `agent-sdk dev` would otherwise keep serving the first load of eval files

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/internal/authored-loaders.jsView on unpkg · L45

dist/channels.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 21

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels.jsView on unpkg

dist/internal/cli-slack-manual.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/cli-slack-manual.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/cli-slack-manual.jsView on unpkg

dist/internal/open-browser.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/open-browser.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/open-browser.jsView on unpkg

dist/channels/github/auth.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/channels/github/auth.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/channels/github/auth.jsView on unpkg

dist/internal/http-channel.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/http-channel.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/http-channel.jsView on unpkg

dist/channels/github/github-channel.jsView file

•matchType = token_shingles matchedPackage = @cursor/july@0.1.107 matchedPath = dist/channels/github/github-channel.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 0.750 shingleOverlap = 36 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/channels/github/github-channel.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 271-311json

271 "import": "./dist/kv.js",

272 "default": "./dist/kv.js"

273 },

274 "./otel": {

275 "anysphere-source": "./src/otel-public.ts",

276 "types": "./dist/otel-public.d.ts",

277 "import": "./dist/otel-public.js",

278 "default": "./dist/otel-public.js"

279 },

280 "./package.json": {

281 "anysphere-source": "./package.json",

282 "bun": "./package.json",

283 "types": "./package.json",

284 "import": "./package.json",

285 "default": "./package.json"

286 }

287 },

288 "scripts": {

289 "build": "tsgo -p tsconfig.build.json && node scripts/bundle-publish-shims.mjs && node scripts/copy-extension-assets.mjs && pnpm run build:playground && pnpm run docs:build",

290 "build:dist": "node scripts/build-hosted-dist.mjs",

291 "postinstall": "node -e \"try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L291

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L291

292 "build:playground": "vite build --config playground/vite.config.ts",

293 "build:playground:central": "vite build --mode central --config playground/vite.config.ts",

294 "dev:playground": "vite --config playground/vite.config.ts",

295 "check": "biome check src && tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",

296 "docs:dev": "vitepress dev docs",

297 "docs:build": "vitepress build docs",

298 "docs:preview": "vitepress preview docs",

299 "docs:verify-links": "node scripts/verify-docs-links.mjs",

300 "fix": "biome check --write --unsafe src",

301 "test": "vitest run --passWithNoTests",

302 "type-check": "tsgo --noEmit && tsgo --noEmit -p playground/tsconfig.json",

303 "build-dev": "echo noop",

304 "build-types": "tsgo -p tsconfig.build.json --emitDeclarationOnly",

305 "verify-publish": "node scripts/verify-publish-artifacts.mjs",

306 "smoke-publish": "node scripts/smoke-publish-artifact.mjs",

307 "publish-check": "pnpm run build && pnpm run verify-publish && pnpm run smoke-publish"

308 },

309 "engines": {

310 "node": ">=22.13"

311 },

•matchType = token_shingles matchedPackage = @cursor/july@0.1.107 matchedPath = package.json matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

package.jsonView on unpkg

dist/internal/authored-loaders.jsView file

Lines 25-65javascript

25 function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }

26 step((generator = generator.apply(thisArg, _arguments || [])).

dist/channels.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 21

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels.jsView on unpkg

dist/internal/cli-slack-manual.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/cli-slack-manual.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/cli-slack-manual.jsView on unpkg

dist/internal/open-browser.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/open-browser.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/open-browser.jsView on unpkg

dist/channels/github/auth.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/channels/github/auth.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/channels/github/auth.jsView on unpkg

dist/internal/http-channel.jsView file

•matchType = normalized_sha256 matchedPackage = @cursor/july@0.1.107 matchedPath = dist/internal/http-channel.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/internal/http-channel.jsView on unpkg

dist/channels/github/github-channel.jsView file

•matchType = token_shingles matchedPackage = @cursor/july@0.1.107 matchedPath = dist/channels/github/github-channel.js matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 0.750 shingleOverlap = 36 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/channels/github/github-channel.jsView on unpkg