@cursor/sdk@1.0.37
TypeScript SDK for Cursor agents.
AI Security Review
scanned 28d ago · by lpm-firewall-aiThe default credential destination is package-aligned, but CURSOR_BACKEND_URL can redirect the exchange without an inspected destination restriction. This is a conditional credential-exposure risk, so it warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An SDK analytics event is tracked while a credential is available.
Impact
If CURSOR_BACKEND_URL is set to an unintended host, the key may be exposed during token exchange.
Mechanism
The SDK obtains a key from CURSOR_API_KEY or the local Cursor auth file and constructs its token provider with CURSOR_BACKEND_URL, defaulting to api2.cursor.sh.
AI rationale
The default credential destination is package-aligned, but CURSOR_BACKEND_URL can redirect the exchange without an inspected destination restriction. This is a conditional credential-exposure risk, so it warrants a warning rather than a block.
Evidence
dist/cjs/index.js
Network endpoints2
api2.cursor.shCURSOR_BACKEND_URL
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest points to bundled and ESM/CJS SDK entrypoints and declares no npm lifecycle hooks.
- The SDK reads credentials from CURSOR_API_KEY or the stored .cursor/sdk/auth.json file.
- The telemetry client passes the API key to an access-token exchange using CURSOR_BACKEND_URL when set, with api2.cursor.sh as the default.
- The inspected agent integration excerpts show credential-store and project-path handling; they do not establish a separate agent configuration attack.
Evidence against
- The manifest identifies the package as Cursor’s SDK and points its repository to github.com/cursor/cursor.
- The default credential-exchange host is api2.cursor.sh, a Cursor host.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
15 flaggeddist/esm/index.jsView file
1import*as t from"@bufbuild/protobuf";import*as r from"@connectrpc/connect";import*as e from"assert";import*as n from"buffer";import*as s from"crypto";import*as i from"events";impor...
High
1import*as t from"@bufbuild/protobuf";import*as r from"@connectrpc/connect";import*as e from"assert";import*as n from"buffer";import*as s from"crypto";import*as i from"events";impor...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/esm/index.jsView on unpkg · L11import*as t from"@bufbuild/protobuf";import*as r from"@connectrpc/connect";import*as e from"assert";import*as n from"buffer";import*as s from"crypto";import*as i from"events";impor...
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/esm/index.jsView on unpkg · L1Findings
1 Critical10 High5 Medium7 Low
CriticalPrevious Version Dangerous Deltadist/cjs/464.js
HighChild Processdist/esm/index.js
HighSame File Env Network Executiondist/esm/index.js
HighCredential Redirect Persistencedist/cjs/index.js
HighCommand Output Exfiltrationdist/esm/index.js
HighSandbox Evasion Gated Capabilitydist/esm/index.js
HighObfuscated Payload Loaderdist/bundled/index.js
HighRemote Agent Bridgedist/bundled/index.js
HighCross File Remote Execution Contextdist/bundled/index.js
HighTrigger Reachable Command Output Exfiltrationdist/cjs/index.js
HighSemantic Analysis Limiteddist/bundled/index.js
Affected versions and remediation
This report applies to @cursor/sdk@1.0.37.
See all versions of @cursor/sdk for other recorded verdicts.
- Review the evidence and your use of @cursor/sdk@1.0.37 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.