Loading npm security reports…

@cursor/july@0.2.12: Suspicious npm security report (Warn) | LPM Firewall

registry / @cursor/july / 0.2.12

@cursor/july@0.2.12

Build, test, and deploy BDK bots and agents as code on Cursor's agent harness.

AI Security Review

scanned 10h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. The package automatically installs its own Cursor skills during npm postinstall, and Slack session handling can add local Cursor hooks for follow-up context. These are package-owned agent integrations; the inspected source does not establish a separate active attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm package installation triggers skill synchronization; Slack session handling with a continuation key triggers nudge carrier setup.

Impact

Package skills become available to Cursor, and Slack follow-up context can be loaded during tool use. A guarded agent extension capability is present, but no confirmed malicious action was identified.

Mechanism

The installer synchronizes package skills into the user's Cursor skills namespace. The Slack helper writes local carrier files and registers pre-tool and post-tool commands in the project hooks configuration.

AI rationale

Source inspection confirms automatic, package-owned Cursor skill setup and a Slack continuation hook integration. These warrant a warning for agent extension lifecycle risk; the reviewed evidence does not establish credential theft, broad foreign configuration mutation, or another concrete attack.

Evidence

package.jsonscripts/install-cursor-skills.mjsdist/internal/install-cursor-skills.jsdist/channels/slack/nudge-carrier.jsdist/internal/session-engine.js

Decision evidence

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•matchType = token_shingles matchedPackage = @cursor/july@0.1.107 matchedPath = package.json matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

package.jsonView on unpkg

dist/internal/authored-loaders.jsView file

36* L37: * Node caches `import()` by URL for the life of the process, so a long-lived L38: * `agent-sdk dev` would otherwise keep serving the first load of eval files

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/internal/authored-loaders.jsView on unpkg · L36

dist/channels/slack/slack-channel.jsView file

185package = @cursor/july; repositoryIdentity = cursor; dependency = @slack/web-api L185: } L186: const { WebClient } = await import("@slack/web-api"); L187: allowlist.applyResolvedNames(await resolveChannelNames(new WebClient(botToken), names, getLog()));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/channels/slack/slack-channel.jsView on unpkg · L185

dist/channels.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 14

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{const p='./scripts/install-cursor-skills.mjs';if(require('fs').existsSync(p))require('child_process').execFileSync(process.execPath,[p],{stdio:'inherit'})}catch{}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•matchType = token_shingles matchedPackage = @cursor/july@0.1.107 matchedPath = package.json matchedIdentity = npm:QGN1cnNvci9qdWx5:0.1.107 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

package.jsonView on unpkg

dist/internal/authored-loaders.jsView file

Lines 16-56javascript

16 * source still retry against this package (hosted factory engines).

17 * Source runs (tsx from the monorepo) skip both — the host loader and

18 * tsconfig paths already cover them.

19 */

20import { existsSync } from

dist/channels/slack/slack-channel.jsView file

Lines 165-205javascript

165 let channelWatch;

166 let botMentionGate;

167 // Hosted admission never runs the Socket Mode branch of `onStart`, so the

168 // channel watch is built per delivery there. The allowlist and its `#name`

169 // resolution are shared across the pod; the bot's identity comes from the

170 // verified envelope.

171 let

dist/channels.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 14

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/channels.jsView on unpkg