registry / @s2code/t3-linux-arm64 / 0.1.3-nightly.20261027.66
@s2code/t3-linux-arm64@0.1.3-nightly.20261027.66
⚠ Under reviews2code CLI executable for linux-arm64
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe manifest shows a native CLI payload that was unreadable during source inspection, while the flagged SQL operations resolve paths in a virtual filesystem. No concrete attack was established, but the executable’s behavior remains unresolved, so manual review is appropriate.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user invokes the packaged CLI.
Impact
Unknown; the inspected source did not establish a harmful effect.
Mechanism
The executable is binary, so its behavior could not be determined through source inspection.
AI rationale
The manifest shows a native CLI payload that was unreadable during source inspection, while the flagged SQL operations resolve paths in a virtual filesystem. No concrete attack was established, but the executable’s behavior remains unresolved, so manual review is appropriate.
Evidence
package.jsont3
Decision evidence
public snapshotAI called this Manual Review at 78.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest identifies a Linux ARM64 CLI and includes a native executable named `t3`; reading that executable as source failed because it is binary.
- The flagged SQL bundle excerpts normalize paths and resolve parent and child entries in a virtual filesystem.
- The manifest contains no lifecycle scripts or JavaScript entry point, so no install-time package hook was observed.
Evidence against
- The inspected source excerpts established no concrete malicious behavior.
Behavioral surface
DynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggednode_modules/@cursor/sdk/dist/esm/250.jsView file
1/*! For license information please see 250.js.LICENSE.txt */
L2: export const __webpack_esm_id__=250;export const __webpack_esm_ids__=[250];export const __webpack_esm_modules__={"../../node_modules/.pnpm/exif-parser@0.1.12/node_modules/exif-pars...
Low
Eval
Package source references a known benign dynamic code generation pattern.
node_modules/@cursor/sdk/dist/esm/250.jsView on unpkg · L1node_modules/@bufbuild/protobuf/dist/cjs/is-message.jsView file
16exports.isMessage = void 0;
L17: const message_js_1 = require("./message.js");
L18: /**
Medium
Dynamic Require
Package source references dynamic require/import behavior.
node_modules/@bufbuild/protobuf/dist/cjs/is-message.jsView on unpkg · L16Findings
1 Critical8 High8 Medium5 Low
CriticalTrojan Source Unicodeclient/assets/ChatMarkdown-rjcJFo7z.js
HighSame File Env Network Executionnode_modules/@cursor/sdk/dist/esm/748.js
HighCommand Output Exfiltrationnode_modules/@cursor/sdk/dist/esm/748.js
HighSandbox Evasion Gated Capabilitynode_modules/@cursor/sdk/dist/esm/index.js
HighObfuscated Payload Loadernode_modules/playwright-core/lib/coreBundle.js
HighExternal Ai Agent Control Surface Mutationnode_modules/playwright-core/lib/coreBundle.js
HighCross File Remote Execution Contextnode_modules/@cursor/sdk/dist/bundled/index.js
HighShips High Entropy Blobclient/assets/FoxitSerifItalic-CQs5lx9Y.pfb
HighSemantic Analysis Limitedclient/assets/sql-wasm-browser-BroI9skw.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @s2code/t3-linux-arm64@0.1.3-nightly.20261027.66.
See all versions of @s2code/t3-linux-arm64 for other recorded verdicts.
- Review the evidence and your use of @s2code/t3-linux-arm64@0.1.3-nightly.20261027.66 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.