registry / @s2code/t3-linux-arm64 / 0.1.6-nightly.20261103.81
@s2code/t3-linux-arm64@0.1.6-nightly.20261103.81
s2code CLI executable for linux-arm64
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package is described as a Linux ARM64 s2code CLI, with no lifecycle scripts or JavaScript entry point in its manifest. The flagged installer and agent-skill actions are setup features requiring user-directed actions, and the reviewed GitHub token use is for GitHub release access.
Static reason
One or more suspicious static signals were detected.
Trigger
The package has no lifecycle hook; setup commands and the Playwright skill installer require user-directed actions.
Impact
No unrequested credential collection, external configuration mutation, or harmful automatic execution was identified.
Mechanism
The flagged code supports CLI setup, GitHub release downloads using a supplied GitHub token, and an explicit Playwright trace-skill install command.
AI rationale
The package is described as a Linux ARM64 s2code CLI, with no lifecycle scripts or JavaScript entry point in its manifest. The flagged installer and agent-skill actions are setup features requiring user-directed actions, and the reviewed GitHub token use is for GitHub release access.
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes a Linux ARM64 s2code CLI package.
- The setup UI contains official Claude and ChatGPT installer commands.
- The Cursor SDK sends a provided GitHub token to GitHub's release API for release downloads.
- Playwright installs its trace skill only through the explicit `trace install-skill` command.
Evidence against
- The manifest has no lifecycle scripts or JavaScript entry point.
- The flagged installer commands are presented as setup commands, not package install hooks.
- The Playwright skill write is gated by an explicit CLI subcommand.
Behavioral surface
DynamicRequireEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
16 flaggednode_modules/@cursor/sdk/dist/esm/250.jsView file
1/*! For license information please see 250.js.LICENSE.txt */
L2: export const __webpack_esm_id__=250;export const __webpack_esm_ids__=[250];export const __webpack_esm_modules__={"../../node_modules/.pnpm/exif-parser@0.1.12/node_modules/exif-pars...
Low
Eval
Package source references a known benign dynamic code generation pattern.
node_modules/@cursor/sdk/dist/esm/250.jsView on unpkg · L1client/assets/document.worker-IFIwCk8M.jsView file
7`)}return t},ir=Pn,ar=`~effect/Duration`,or=/*#__PURE__*/ BigInt(0),sr=/*#__PURE__*/ BigInt(1),cr=/*#__PURE__*/ BigInt(2),lr=/*#__PURE__*/ BigInt(10),ur=/*#__PURE__*/ BigInt(1e3),d...
L8: `);n=_o(e)??fo(Va(e.ast),e);break;default:n=so(e)}return t?`${n}\n at ${t}`:n}function _o(e){if(e._tag===`Pointer`)return;if(e._tag===`Encoding`)return _o(e.issue);let t=(e._tag==...
L9: //# sourceMappingURL=document.worker-IFIwCk8M.js.map
Medium
Dynamic Require
Package source references dynamic require/import behavior.
client/assets/document.worker-IFIwCk8M.jsFindings
8 High8 Medium5 Low
HighSame File Env Network Executionnode_modules/@cursor/sdk/dist/esm/748.js
HighCommand Output Exfiltrationnode_modules/@cursor/sdk/dist/esm/748.js
HighSandbox Evasion Gated Capabilitynode_modules/@cursor/sdk/dist/esm/index.js
HighObfuscated Payload Loadernode_modules/playwright-core/lib/coreBundle.js
HighExternal Ai Agent Control Surface Mutationnode_modules/playwright-core/lib/coreBundle.js
HighCross File Remote Execution Contextnode_modules/@cursor/sdk/dist/bundled/index.js
HighShips High Entropy Blobclient/assets/FoxitSerifItalic-CQs5lx9Y.pfb
HighSemantic Analysis Limitedclient/assets/77XECAW3--h0QZOXu.js#virtual:normalized:round1
MediumDynamic Requireclient/assets/document.worker-IFIwCk8M.js
Affected versions and remediation
This report applies to @s2code/t3-linux-arm64@0.1.6-nightly.20261103.81.
See all versions of @s2code/t3-linux-arm64 for other recorded verdicts.
- Review the evidence and your use of @s2code/t3-linux-arm64@0.1.6-nightly.20261103.81 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.