registry / @s2code/t3-linux-arm64 / 0.1.3-nightly.20261028.69
@s2code/t3-linux-arm64@0.1.3-nightly.20261028.69
⚠ Under reviews2code CLI executable for linux-arm64
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest shows a Linux arm64 CLI package with a bundled executable, but the executable’s binary contents were unreadable through the source inspection interface. The flagged Unicode excerpt is insufficient to establish malicious behavior, so the core runtime remains unresolved.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the bundled CLI executable; its behavior could not be determined from inspected source.
Impact
The executable’s effects on the system remain unknown; no specific attack was established.
Mechanism
The executable is present as binary data and the available source inspection did not resolve its behavior.
AI rationale
The manifest shows a Linux arm64 CLI package with a bundled executable, but the executable’s binary contents were unreadable through the source inspection interface. The flagged Unicode excerpt is insufficient to establish malicious behavior, so the core runtime remains unresolved.
Evidence
package.jsont3t3.exe
Decision evidence
public snapshotAI called this Manual Review at 66.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest identifies this as a Linux arm64 CLI package that includes a `t3` executable, whose binary contents could not be inspected as source.
- The manifest ends with its dependency list and declares no lifecycle scripts; this does not resolve what the bundled executable does.
Evidence against
- The flagged Unicode-heavy text is in a minified client asset and appears beside ligature-like glyph data; that excerpt alone does not establish Trojan Source behavior.
- The client asset uses ordinary application asset imports, including math typesetting and React modules.
Behavioral surface
DynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggednode_modules/@cursor/sdk/dist/esm/250.jsView file
1/*! For license information please see 250.js.LICENSE.txt */
L2: export const __webpack_esm_id__=250;export const __webpack_esm_ids__=[250];export const __webpack_esm_modules__={"../../node_modules/.pnpm/exif-parser@0.1.12/node_modules/exif-pars...
Low
Eval
Package source references a known benign dynamic code generation pattern.
node_modules/@cursor/sdk/dist/esm/250.jsView on unpkg · L1node_modules/@bufbuild/protobuf/dist/cjs/is-message.jsView file
16exports.isMessage = void 0;
L17: const message_js_1 = require("./message.js");
L18: /**
Medium
Dynamic Require
Package source references dynamic require/import behavior.
node_modules/@bufbuild/protobuf/dist/cjs/is-message.jsView on unpkg · L16Findings
1 Critical8 High8 Medium5 Low
CriticalTrojan Source Unicodeclient/assets/ChatMarkdown-C0yroozY.js
HighSame File Env Network Executionnode_modules/@cursor/sdk/dist/esm/748.js
HighCommand Output Exfiltrationnode_modules/@cursor/sdk/dist/esm/748.js
HighSandbox Evasion Gated Capabilitynode_modules/@cursor/sdk/dist/esm/index.js
HighObfuscated Payload Loadernode_modules/playwright-core/lib/coreBundle.js
HighExternal Ai Agent Control Surface Mutationnode_modules/playwright-core/lib/coreBundle.js
HighCross File Remote Execution Contextnode_modules/@cursor/sdk/dist/bundled/index.js
HighShips High Entropy Blobclient/assets/FoxitSerifItalic-CQs5lx9Y.pfb
HighSemantic Analysis Limitedclient/assets/77XECAW3-BhAU27MW.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @s2code/t3-linux-arm64@0.1.3-nightly.20261028.69.
See all versions of @s2code/t3-linux-arm64 for other recorded verdicts.
- Review the evidence and your use of @s2code/t3-linux-arm64@0.1.3-nightly.20261028.69 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.