registry / cursor-package-funtech / 1.0.4

cursor-package-funtech@1.0.4

Cursor rules and skills (.cursor) for React + Vite + SCSS projects

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Installing the package mutates the consuming project's Cursor configuration, package.json, .gitignore, and an existing Husky hook. It installs local commit-review automation that can block commits.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install runs postinstall; later git commit triggers the installed hooks.

Impact

The package gains recurring local execution during commits and can prevent commits based on its review rules.

Mechanism

Automatic project configuration and commit-hook installation.

AI rationale

This is a disclosed, package-aligned Cursor extension with local-only review logic, not confirmed malware. Its postinstall mutation of project configuration and commit hooks is a real lifecycle risk that warrants a warning.

Evidence

package.jsonscripts/install.js.cursor/hooks.json.cursor/hooks/on-git-commit-review.py.cursor/hooks/rules-review.py.cursor.gitignore.husky/pre-commit.cursor/reviews/project.auto.md

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as with false-positive risk.

cursor-package-funtech@1.0.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code