@cursor/sdk@1.0.32
TypeScript SDK for Cursor agents.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe credential-forwarding path is concrete but conditional on a caller or environment setting CURSOR_BACKEND_URL. There is no evidence of automatic installation-time execution or independent malicious activity.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A caller invokes a cloud SDK operation while CURSOR_BACKEND_URL points to a non-default endpoint.
Impact
A hostile or misconfigured operator-controlled endpoint could receive the API key.
Mechanism
The client reads an API key, constructs a Bearer authorization header, and passes it to fetch using the selected base URL.
AI rationale
The credential-forwarding path is concrete but conditional on a caller or environment setting CURSOR_BACKEND_URL. There is no evidence of automatic installation-time execution or independent malicious activity.
Evidence
dist/esm/index.js
Network endpoints2
api.cursor.comapi2.cursor.sh
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package has no npm preinstall, install, or postinstall hook; its listed lifecycle-related script is prepublish-only testing.
- The active ESM entry obtains an API key from CURSOR_API_KEY or a local stored-credentials file.
- The cloud client accepts CURSOR_BACKEND_URL as its base URL, adds the API key as a Bearer authorization header, and sends requests with fetch.
- This permits an operator-controlled backend URL to receive an existing Cursor API key when cloud SDK operations are invoked.
Evidence against
- The default cloud API endpoints are Cursor-owned hosts.
- No automatic install-time execution or destructive behavior was identified in the inspected entrypoint.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
15 flaggeddist/esm/index.jsView file
1import{fileURLToPath as t}from"node:url";var r=t(import.meta.url);import*as e from"@bufbuild/protobuf";import*as n from"@connectrpc/connect";import*as s from"assert";import*as o fr...
High
dist/esm/360.jsView file
1/*! For license information please see 360.js.LICENSE.txt */
L2: export const __webpack_esm_id__=360;export const __webpack_esm_ids__=[360];export const __webpack_esm_modules__={"../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@op...
L3: || (${a} == "string" && ${i} && ${i} == +${i})`).assign(l,o._`+${i}`);case"integer":return void n.elseIf(o._`${a} === "boolean" || ${i} === null
...
L7: depsCount: ${t},
L8: deps: ${s}}`};const o={keyword:"dependencies",type:"object",schemaType:"object",error:t.error,code(e){const[t,s]=function({schema:e}){const t={},s={};for(const n in e)"__proto__"!=...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/360.jsView on unpkg · L1Findings
1 Critical10 High5 Medium8 Low
CriticalPrevious Version Dangerous Deltadist/bundled/index.js
HighChild Processdist/esm/index.js
HighSame File Env Network Executiondist/esm/360.js
HighCredential Redirect Persistencedist/cjs/index.js
HighCommand Output Exfiltrationdist/esm/360.js
HighObfuscated Payload Loaderdist/bundled/index.js
HighRemote Agent Bridgedist/bundled/index.js
HighCopied Package Dependency Bridgedist/cjs/index.js
HighCross File Remote Execution Contextdist/bundled/index.js
HighTrigger Reachable Command Output Exfiltrationdist/cjs/index.js
HighSemantic Analysis Limiteddist/bundled/index.js
Affected versions and remediation
This report applies to @cursor/sdk@1.0.32.
See all versions of @cursor/sdk for other recorded verdicts.
- Review the evidence and your use of @cursor/sdk@1.0.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.