registry / @s2code/t3-linux-arm64 / 0.1.5-nightly.20261031.75
@s2code/t3-linux-arm64@0.1.5-nightly.20261031.75
s2code CLI executable for linux-arm64
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe manifest describes a platform-specific CLI executable package, and the reviewed suspicious indicators are conditional setup features rather than automatic behavior. No malicious data flow or install-time action was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
Provider setup requires a UI click; Playwright skill setup requires the explicit --init-workspace option.
Impact
No automatic credential collection, unrelated data transfer, or install-time agent configuration change was identified.
Mechanism
The UI includes official installer command strings, while Playwright copies its skill into a project directory only during explicit workspace initialization.
AI rationale
The manifest describes a platform-specific CLI executable package, and the reviewed suspicious indicators are conditional setup features rather than automatic behavior. No malicious data flow or install-time action was identified.
Network endpoints2
claude.aichatgpt.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as the Linux ARM64 s2code CLI executable package.
- The ChatGPT setup action is click-driven and calls its setup handler only when selected.
- Playwright skill installation is behind the explicit --init-workspace command option.
Evidence against
- A UI asset contains shell commands for downloading the official Claude and ChatGPT installers.
- Playwright code copies a skill into the project when its workspace initialization option is used.
Behavioral surface
DynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
16 flaggednode_modules/@cursor/sdk/dist/esm/250.jsView file
1/*! For license information please see 250.js.LICENSE.txt */
L2: export const __webpack_esm_id__=250;export const __webpack_esm_ids__=[250];export const __webpack_esm_modules__={"../../node_modules/.pnpm/exif-parser@0.1.12/node_modules/exif-pars...
Low
Eval
Package source references a known benign dynamic code generation pattern.
node_modules/@cursor/sdk/dist/esm/250.jsView on unpkg · L1client/assets/PdfViewer-CqsVycSl.jsView file
1import{i as e}from"./rolldown-runtime-COiEfhsA.js";import{t}from"./react-BP46yLMB.js";import{n,t as r}from"./jsx-runtime-BQExFN_X.js";import{t as i}from"./chevron-down-DCtnKCvY.js"...
L2: struct Uniforms {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
client/assets/PdfViewer-CqsVycSl.jsView on unpkg · L1Findings
8 High8 Medium5 Low
HighSame File Env Network Executionnode_modules/@cursor/sdk/dist/esm/748.js
HighCommand Output Exfiltrationnode_modules/@cursor/sdk/dist/esm/748.js
HighSandbox Evasion Gated Capabilitynode_modules/@cursor/sdk/dist/esm/index.js
HighObfuscated Payload Loadernode_modules/playwright-core/lib/coreBundle.js
HighExternal Ai Agent Control Surface Mutationnode_modules/playwright-core/lib/coreBundle.js
HighCross File Remote Execution Contextnode_modules/@cursor/sdk/dist/bundled/index.js
HighShips High Entropy Blobclient/assets/FoxitSerifItalic-CQs5lx9Y.pfb
HighSemantic Analysis Limitedclient/assets/77XECAW3-Cys5Nrf0.js#virtual:normalized:round1
MediumDynamic Requireclient/assets/PdfViewer-CqsVycSl.js
Medium
Affected versions and remediation
This report applies to @s2code/t3-linux-arm64@0.1.5-nightly.20261031.75.
See all versions of @s2code/t3-linux-arm64 for other recorded verdicts.
- Review the evidence and your use of @s2code/t3-linux-arm64@0.1.5-nightly.20261031.75 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.