registry / @cursor/sdk / 1.2.0
@cursor/sdk@1.2.0
TypeScript SDK for Cursor agents.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest points to SDK entrypoints and contains no install hook. The flagged evaluation is part of an image metadata parser, while shell and network behavior appears within the agent SDK’s invoked runtime; no concrete attack behavior was established.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An application imports the SDK and invokes its agent or analytics APIs.
Impact
Invoked agent operations can affect the application environment; inspected evidence does not establish unconsented collection or unrelated disclosure.
Mechanism
The SDK supports agent operations and sends SDK events to a Cursor backend configured by the application or the package default.
AI rationale
The manifest points to SDK entrypoints and contains no install hook. The flagged evaluation is part of an image metadata parser, while shell and network behavior appears within the agent SDK’s invoked runtime; no concrete attack behavior was established.
Network endpoints1
api2.cursor.sh
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json routes imports to the SDK’s bundled and module entrypoints and declares no install lifecycle hook.
- The runtime uses Cursor’s configured backend for SDK analytics; the inspected code does not establish unrelated credential forwarding or an unrequested account action.
- The eval match is in the bundled image metadata parser, and inspected dependency excerpts show protobuf and RPC library code.
Evidence against
- The SDK includes shell execution and agent runtime capabilities, which can perform consequential actions when an application invokes them.
- Telemetry can be sent to the configured Cursor backend; the inspected excerpts do not show collection of secrets or an unrelated recipient.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
15 flaggeddist/esm/index.jsView file
1import*as t from"@bufbuild/protobuf";import*as r from"@connectrpc/connect";import*as e from"assert";import*as n from"buffer";import*as s from"crypto";import*as i from"events";impor...
High
1import*as t from"@bufbuild/protobuf";import*as r from"@connectrpc/connect";import*as e from"assert";import*as n from"buffer";import*as s from"crypto";import*as i from"events";impor...
High
Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/esm/index.jsView on unpkg · L1dist/esm/250.jsView file
1/*! For license information please see 250.js.LICENSE.txt */
L2: export const __webpack_esm_id__=250;export const __webpack_esm_ids__=[250];export const __webpack_esm_modules__={"../../node_modules/.pnpm/exif-parser@0.1.12/node_modules/exif-pars...
Findings
3 Critical10 High5 Medium5 Low
CriticalSame File Env Network Executiondist/esm/336.js
CriticalTrigger Reachable Dangerous Capabilitydist/bundled/index.js
CriticalPrevious Version Dangerous Deltadist/bundled/index.js
HighChild Processdist/esm/index.js
HighEvaldist/esm/250.js
HighCredential Redirect Persistencedist/cjs/index.js
HighCommand Output Exfiltrationdist/esm/587.js
HighSandbox Evasion Gated Capabilitydist/esm/index.js
HighObfuscated Payload Loaderdist/bundled/index.js
HighRemote Agent Bridgedist/bundled/index.js
HighCross File Remote Execution Contextdist/bundled/index.js
Affected versions and remediation
This report applies to @cursor/sdk@1.2.0.
See all versions of @cursor/sdk for other recorded verdicts.
- Review the evidence and your use of @cursor/sdk@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.