registry / @s2code/t3-linux-arm64 / 0.1.3-nightly.20261029.72
@s2code/t3-linux-arm64@0.1.3-nightly.20261029.72
s2code CLI executable for linux-arm64
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe manifest presents a platform-specific CLI package and defines no lifecycle hook or entry point. The flagged installer commands appear as UI data, and the reviewed evidence does not establish an automatic attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No install-time or import-time attack trigger was found; the installer commands appear as client-side strings.
Impact
No malicious impact was identified from the reviewed evidence.
Mechanism
No concrete credential theft, unrelated data collection, destructive action, persistence, or concealed execution was established.
AI rationale
The manifest presents a platform-specific CLI package and defines no lifecycle hook or entry point. The flagged installer commands appear as UI data, and the reviewed evidence does not establish an automatic attack.
Decision evidence
public snapshotAI called this Clean at 78.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- The manifest describes a Linux ARM64 s2code CLI executable package.
- The manifest ends without defining lifecycle scripts or an entry point.
- The flagged installer commands are strings for official Claude and ChatGPT Codex installer URLs in a client asset; no automatic invocation was identified.
Evidence against
- The package includes a native executable and substantial bundled client and dependency code, so not every runtime path was inspected.
- Static findings flag bidi characters in a client asset, but the inspected match occurs in encoded-looking bundled data and does not establish hidden executable behavior.
Behavioral surface
DynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggednode_modules/@cursor/sdk/dist/esm/250.jsView file
1/*! For license information please see 250.js.LICENSE.txt */
L2: export const __webpack_esm_id__=250;export const __webpack_esm_ids__=[250];export const __webpack_esm_modules__={"../../node_modules/.pnpm/exif-parser@0.1.12/node_modules/exif-pars...
Low
Eval
Package source references a known benign dynamic code generation pattern.
node_modules/@cursor/sdk/dist/esm/250.jsView on unpkg · L1client/assets/PdfViewer-Cx26QneD.jsView file
1import{i as e}from"./rolldown-runtime-COiEfhsA.js";import{t}from"./react-BP46yLMB.js";import{n,t as r}from"./jsx-runtime-BQExFN_X.js";import{a as i}from"./search-Jis1E8Us.js";impor...
L2: struct Uniforms {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
client/assets/PdfViewer-Cx26QneD.jsView on unpkg · L1Findings
1 Critical8 High8 Medium5 Low
CriticalTrojan Source Unicodeclient/assets/ChatMarkdown-C6L4Kq1s.js
HighSame File Env Network Executionnode_modules/@cursor/sdk/dist/esm/748.js
HighCommand Output Exfiltrationnode_modules/@cursor/sdk/dist/esm/748.js
HighSandbox Evasion Gated Capabilitynode_modules/@cursor/sdk/dist/esm/index.js
HighObfuscated Payload Loadernode_modules/playwright-core/lib/coreBundle.js
HighExternal Ai Agent Control Surface Mutationnode_modules/playwright-core/lib/coreBundle.js
HighCross File Remote Execution Contextnode_modules/@cursor/sdk/dist/bundled/index.js
HighShips High Entropy Blobclient/assets/FoxitSerifItalic-CQs5lx9Y.pfb
HighSemantic Analysis Limitedclient/assets/77XECAW3-D-MsWyCq.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @s2code/t3-linux-arm64@0.1.3-nightly.20261029.72.
See all versions of @s2code/t3-linux-arm64 for other recorded verdicts.
- Review the evidence and your use of @s2code/t3-linux-arm64@0.1.3-nightly.20261029.72 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.