registry / @cursor/sdk / 1.0.40
@cursor/sdk@1.0.40
⚠ Under reviewTypeScript SDK for Cursor agents.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe inspected runtime behavior is consistent with an agent SDK and does not establish a concrete attack. The supplied dependency evidence leaves a selected optional platform dependency unresolved, which prevents a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The inspected executor is loaded when the runtime requests local agent execution; the unresolved dependency is relevant when that platform-specific package is selected.
Impact
No attack impact was confirmed; assessment of the unresolved dependency is needed before clearing the package.
Mechanism
The executor can run shell commands as part of agent operation. The unresolved dependency source could not be assessed from the supplied evidence.
AI rationale
The inspected runtime behavior is consistent with an agent SDK and does not establish a concrete attack. The supplied dependency evidence leaves a selected optional platform dependency unresolved, which prevents a clean verdict.
Evidence
package.jsondist/esm/index.jsdist/esm/331.js
Decision evidence
public snapshotAI called this Manual Review at 75.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The package exports its CommonJS and ESM runtime through the declared entrypoints in package.json.
- The ESM entrypoint loads the local executor lazily, and that executor logs shell commands with their working directory.
- The manifest declares a platform-specific optional dependency for Linux ARM64; its source remains unresolved in the supplied dependency evidence.
Evidence against
- The inspected executor behavior is consistent with a caller-invoked agent SDK capability; no concrete attack behavior was established in the inspected excerpts.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
15 flaggeddist/cjs/index.jsView file
1(()=>{"use strict";var t,r,e,n={"../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@[redacted]span_kind.js"(t,r,e){var n;e.d(r,{v:()=>n}),funct...
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cjs/index.js:
(()=>{"use strict";var t,r,e,n={"../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@[redacted]span_kind.js"(t,r,e){var n;e.d(r,{v:()=>n}),funct...
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cjs/index.jsView on unpkg1(()=>{"use strict";var t,r,e,n={"../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@[redacted]span_kind.js"(t,r,e){var n;e.d(r,{v:()=>n}),funct...
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
Findings
3 Critical10 High5 Medium5 Low
CriticalSame File Env Network Executiondist/esm/331.js
CriticalTrigger Reachable Dangerous Capabilitydist/bundled/index.js
CriticalPrevious Version Dangerous Deltadist/bundled/index.js
HighChild Processdist/cjs/index.js
HighEvaldist/bundled/index.js
HighCredential Redirect Persistencedist/cjs/index.js
HighCommand Output Exfiltrationdist/esm/331.js
HighSandbox Evasion Gated Capabilitydist/cjs/index.js
HighObfuscated Payload Loaderdist/bundled/index.js
HighRemote Agent Bridgedist/bundled/index.js
HighCross File Remote Execution Contextdist/bundled/index.js
Affected versions and remediation
This report applies to @cursor/sdk@1.0.40.
See all versions of @cursor/sdk for other recorded verdicts.
- Review the evidence and your use of @cursor/sdk@1.0.40 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.