registry / @cursor/sdk / 1.0.35
@cursor/sdk@1.0.35
TypeScript SDK for Cursor agents.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspection of all required locations and the authentication callers supports ordinary SDK credential handling and workspace parsing. No concrete malicious behavior or unresolved warning-level capability was established.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Authentication storage is activated through caller-invoked SDK authentication methods; no automatic npm install hook was found.
Impact
The inspected behavior supports SDK authentication and workspace operations without establishing credential theft or agent control hijacking.
Mechanism
Login obtains credentials from the selected backend and records that backend when saving them. Saved credential reuse checks backend equality and expiration.
AI rationale
Inspection of all required locations and the authentication callers supports ordinary SDK credential handling and workspace parsing. No concrete malicious behavior or unresolved warning-level capability was established.
Evidence
.cursor/sdk/auth.json
Network endpoints3
cursor.comapi2.cursor.shapi.cursor.com
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares SDK entrypoints without automatic install hooks or a runtime self-dependency.
- The flagged bundled, CommonJS and ES module locations select .cursor/sdk/auth.json for SDK authentication storage; inspected saves restrict filesystem permissions.
- Both flagged 689.js locations parse workspace paths without writing agent configuration; the inspected caller handles missing terminal directories.
- Saved SDK credentials are reused only when unexpired and their backend matches the selected backend.
- The explicit Cursor.auth.login caller obtains a new API key from the selected backend and optionally saves it with that backend recorded.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
15 flaggeddist/esm/index.jsView file
1import*as t from"@bufbuild/protobuf";import*as r from"@connectrpc/connect";import*as e from"assert";import*as n from"buffer";import*as s from"crypto";import*as o from"events";impor...
High
1import*as t from"@bufbuild/protobuf";import*as r from"@connectrpc/connect";import*as e from"assert";import*as n from"buffer";import*as s from"crypto";import*as o from"events";impor...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/index.jsView on unpkg · L11import*as t from"@bufbuild/protobuf";import*as r from"@connectrpc/connect";import*as e from"assert";import*as n from"buffer";import*as s from"crypto";import*as o from"events";impor...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/esm/index.jsView on unpkg · L1Findings
1 Critical10 High5 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/cjs/689.js
HighChild Processdist/esm/index.js
HighSame File Env Network Executiondist/esm/index.js
HighCredential Redirect Persistencedist/cjs/index.js
HighCommand Output Exfiltrationdist/esm/index.js
HighSandbox Evasion Gated Capabilitydist/esm/index.js
HighObfuscated Payload Loaderdist/bundled/index.js
HighRemote Agent Bridgedist/bundled/index.js
HighCross File Remote Execution Contextdist/bundled/index.js
HighTrigger Reachable Command Output Exfiltrationdist/cjs/index.js
HighSemantic Analysis Limiteddist/bundled/index.js
Affected versions and remediation
This report applies to @cursor/sdk@1.0.35.
See all versions of @cursor/sdk for other recorded verdicts.
- Review the evidence and your use of @cursor/sdk@1.0.35 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.