registry / @cursor/sdk / 1.0.29
@cursor/sdk@1.0.29
⚠ Under reviewTypeScript SDK for Cursor agents.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 0.0% confidence. No malicious behavior was detected; 22 low-signal pattern(s) were surfaced and cleared.
Static reason
Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Oversized source lightweight scan
dist/bundled/index.js5.86 MB file, sampled 256 KB
FilesystemNetworkEnvironmentVarsPossibleObfuscationHighEntropyStringsMinifiedUrlStringsapi2.cursor.shcursor.comdocs.statsig.com
Source & flagged code
13 flaggeddist/esm/index.jsView file
1import*as e from"@bufbuild/protobuf";import*as t from"@connectrpc/connect";import*as n from"assert";import*as r from"buffer";import*as s from"crypto";import*as o from"events";impor...
High
1import*as e from"@bufbuild/protobuf";import*as t from"@connectrpc/connect";import*as n from"assert";import*as r from"buffer";import*as s from"crypto";import*as o from"events";impor...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/index.jsView on unpkg · L11import*as e from"@bufbuild/protobuf";import*as t from"@connectrpc/connect";import*as n from"assert";import*as r from"buffer";import*as s from"crypto";import*as o from"events";impor...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/esm/index.jsView on unpkg · L1Findings
1 Critical9 High4 Medium8 Low
CriticalPrevious Version Dangerous Deltadist/cjs/988.js
HighChild Processdist/esm/index.js
HighSame File Env Network Executiondist/esm/index.js
HighCredential Redirect Persistencedist/cjs/index.js
HighCommand Output Exfiltrationdist/esm/index.js
HighObfuscated Payload Loaderdist/bundled/index.js
HighRemote Agent Bridgedist/bundled/index.js
HighCross File Remote Execution Contextdist/bundled/index.js
HighTrigger Reachable Command Output Exfiltrationdist/cjs/index.js
HighSemantic Analysis Limiteddist/bundled/index.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @cursor/sdk@1.0.29.
See all versions of @cursor/sdk for other recorded verdicts.
- Review the evidence and your use of @cursor/sdk@1.0.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.