registry / @s2code/t3-linux-arm64 / 0.1.5-nightly.20261101.78
@s2code/t3-linux-arm64@0.1.5-nightly.20261101.78
s2code CLI executable for linux-arm64
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package is a platform-specific CLI bundle with no declared lifecycle scripts or package entry point. The inspected shell and agent-configuration behaviors are exposed as explicit setup or CLI actions, and the SDK telemetry targets its own backend.
Static reason
One or more suspicious static signals were detected.
Trigger
No install-time or import-time trigger is declared in the package manifest. Setup commands and Playwright skill installation are user-invoked.
Impact
No unauthorized data collection, account action, persistence, or destructive effect was identified.
Mechanism
The inspected code provides setup command strings, Cursor SDK telemetry to its own backend, and an explicit Playwright skill-install command; no automatic credential exfiltration or concealed execution was found.
AI rationale
The package is a platform-specific CLI bundle with no declared lifecycle scripts or package entry point. The inspected shell and agent-configuration behaviors are exposed as explicit setup or CLI actions, and the SDK telemetry targets its own backend.
Evidence
.claude/skills/playwright-trace/SKILL.md
Network endpoints3
chatgpt.comclaude.aiapi2.cursor.sh
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies this as the Linux ARM64 S2Code CLI executable; it defines no lifecycle scripts, main, or bin entry.
- The Codex setup asset contains commands to install Codex from chatgpt.com and selects a command string for the requested platform.
- The bundled Playwright skill write is attached to an explicit `trace install-skill` CLI command.
- The Cursor SDK analytics code sends events to its own backend, api2.cursor.sh.
Evidence against
- The package bundles native executables and browser automation, which can account for scanner hits involving binaries, process execution, and file writes.
- The setup asset includes download-and-run commands, but they are displayed as setup instructions rather than run by the package manifest.
Behavioral surface
DynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscation
Source & flagged code
16 flaggednode_modules/@cursor/sdk/dist/esm/250.jsView file
1/*! For license information please see 250.js.LICENSE.txt */
L2: export const __webpack_esm_id__=250;export const __webpack_esm_ids__=[250];export const __webpack_esm_modules__={"../../node_modules/.pnpm/exif-parser@0.1.12/node_modules/exif-pars...
Low
Eval
Package source references a known benign dynamic code generation pattern.
node_modules/@cursor/sdk/dist/esm/250.jsView on unpkg · L1client/assets/document.worker-IFIwCk8M.jsView file
7`)}return t},ir=Pn,ar=`~effect/Duration`,or=/*#__PURE__*/ BigInt(0),sr=/*#__PURE__*/ BigInt(1),cr=/*#__PURE__*/ BigInt(2),lr=/*#__PURE__*/ BigInt(10),ur=/*#__PURE__*/ BigInt(1e3),d...
L8: `);n=_o(e)??fo(Va(e.ast),e);break;default:n=so(e)}return t?`${n}\n at ${t}`:n}function _o(e){if(e._tag===`Pointer`)return;if(e._tag===`Encoding`)return _o(e.issue);let t=(e._tag==...
L9: //# sourceMappingURL=document.worker-IFIwCk8M.js.map
Medium
Dynamic Require
Package source references dynamic require/import behavior.
client/assets/document.worker-IFIwCk8M.jsFindings
8 High8 Medium5 Low
HighSame File Env Network Executionnode_modules/@cursor/sdk/dist/esm/748.js
HighCommand Output Exfiltrationnode_modules/@cursor/sdk/dist/esm/748.js
HighSandbox Evasion Gated Capabilitynode_modules/@cursor/sdk/dist/esm/index.js
HighObfuscated Payload Loadernode_modules/playwright-core/lib/coreBundle.js
HighExternal Ai Agent Control Surface Mutationnode_modules/playwright-core/lib/coreBundle.js
HighCross File Remote Execution Contextnode_modules/@cursor/sdk/dist/bundled/index.js
HighShips High Entropy Blobclient/assets/FoxitSerifItalic-CQs5lx9Y.pfb
HighSemantic Analysis Limitedclient/assets/77XECAW3-C9uwgq7I.js#virtual:normalized:round1
MediumDynamic Requireclient/assets/document.worker-IFIwCk8M.js
Affected versions and remediation
This report applies to @s2code/t3-linux-arm64@0.1.5-nightly.20261101.78.
See all versions of @s2code/t3-linux-arm64 for other recorded verdicts.
- Review the evidence and your use of @s2code/t3-linux-arm64@0.1.5-nightly.20261101.78 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.