registry / @s2code/t3-linux-arm64 / 0.1.3-nightly.20261030.74
@s2code/t3-linux-arm64@0.1.3-nightly.20261030.74
s2code CLI executable for linux-arm64
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package presents itself as a Linux ARM64 CLI executable and has no npm lifecycle scripts or JavaScript entry point. The flagged setup commands and workspace initialization are user initiated, and the inspected source does not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
No malicious automatic trigger was identified; the inspected setup actions require user initiation.
Impact
No malicious impact was identified.
Mechanism
The package is an architecture-specific CLI distribution. Inspected installer commands are exposed by its UI, and Playwright workspace setup is gated by an explicit CLI option.
AI rationale
The package presents itself as a Linux ARM64 CLI executable and has no npm lifecycle scripts or JavaScript entry point. The flagged setup commands and workspace initialization are user initiated, and the inspected source does not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package identifies itself as a Linux ARM64 CLI executable distribution; package.json declares no lifecycle scripts or JavaScript entry point.
- The UI bundle defines official Claude and Codex installer commands and returns them through a helper; the inspected source does not execute them automatically.
- Playwright workspace initialization is gated by the explicit --init-workspace option, with optional skill installation requested through --init-skills.
Evidence against
Behavioral surface
DynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
17 flaggednode_modules/@cursor/sdk/dist/esm/250.jsView file
1/*! For license information please see 250.js.LICENSE.txt */
L2: export const __webpack_esm_id__=250;export const __webpack_esm_ids__=[250];export const __webpack_esm_modules__={"../../node_modules/.pnpm/exif-parser@0.1.12/node_modules/exif-pars...
Low
Eval
Package source references a known benign dynamic code generation pattern.
node_modules/@cursor/sdk/dist/esm/250.jsView on unpkg · L1client/assets/document.worker-CqgEZqUV.jsView file
7`)}return t},nr=Mn,rr=`~effect/Duration`,ir=/*#__PURE__*/ BigInt(0),ar=/*#__PURE__*/ BigInt(1),or=/*#__PURE__*/ BigInt(2),sr=/*#__PURE__*/ BigInt(10),cr=/*#__PURE__*/ BigInt(1e3),l...
L8: `);n=ho(e)??lo(za(e.ast),e);break;default:n=ao(e)}return t?`${n}\n at ${t}`:n}function ho(e){if(e._tag===`Pointer`)return;if(e._tag===`Encoding`)return ho(e.issue);let t=(e._tag==...
L9: //# sourceMappingURL=document.worker-CqgEZqUV.js.map
Medium
Dynamic Require
Package source references dynamic require/import behavior.
client/assets/document.worker-CqgEZqUV.jsFindings
1 Critical8 High8 Medium5 Low
CriticalTrojan Source Unicodeclient/assets/ChatMarkdown-DOfQ6e7u.js
HighSame File Env Network Executionnode_modules/@cursor/sdk/dist/esm/748.js
HighCommand Output Exfiltrationnode_modules/@cursor/sdk/dist/esm/748.js
HighSandbox Evasion Gated Capabilitynode_modules/@cursor/sdk/dist/esm/index.js
HighObfuscated Payload Loadernode_modules/playwright-core/lib/coreBundle.js
HighExternal Ai Agent Control Surface Mutationnode_modules/playwright-core/lib/coreBundle.js
HighCross File Remote Execution Contextnode_modules/@cursor/sdk/dist/bundled/index.js
HighShips High Entropy Blobclient/assets/FoxitSerifItalic-CQs5lx9Y.pfb
HighSemantic Analysis Limitedclient/assets/77XECAW3-DBJfkikW.js#virtual:normalized:round1
Affected versions and remediation
This report applies to @s2code/t3-linux-arm64@0.1.3-nightly.20261030.74.
See all versions of @s2code/t3-linux-arm64 for other recorded verdicts.
- Review the evidence and your use of @s2code/t3-linux-arm64@0.1.3-nightly.20261030.74 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.