PkgRadar

Package evidence

@gnsx/[email protected]

Remote Payload: matched "curl "

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads
3,131Niche · −30% score
Versions published
2
First published
Jan 2026
Publisher
gnsxrocks

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarballAdd to CI gate
Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@gnsx/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@gnsx/[email protected]"],"fail_on":"review"}'
Publishergnsxrocks
Artifact bytes19,652,544
Previous version5.0.1
Published2026-06-11T14:12:09.648Z
SHA-25693879a04477939f0bacb12ea575da802cdce1c9d560e2c024e5b32733769bcdf

Why flagged

What the scanner saw

Remote Payload: matched "curl "

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review
Last checked
reviewRisk
11Score
11.4.4Version
Status history (1 event)
  1. new → available · risk review · score 11 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/src/electron/backend/gateway/cursor-cli-runtime.jsmatched "curl "12
Show all 2 findings (low-signal and informational)
SeverityKindPathDetailPoints
mediumRemote Payloadpackage/dist/src/electron/backend/gateway/cursor-cli-runtime.jsmatched "curl "12
lowInstall-time lifecycle scriptpackage.jsonpostinstall="pnpm exec tsx scripts/post-install.ts && pnpm generate:build-config"5

Manifest

Package metadata

Scripts31
  • buildpnpm lint && pnpm generate:template-scenes && run-cmd vite build && run-cmd tsup && pnpm compile
  • check:cli-isolationrun-cmd pnpm exec tsx --import ./scripts/register-electron-mock.mjs node_modules/qunit/bin/qunit.js test/gateway-cli-isolation.test.ts
  • check:gateway-runtimepnpm exec tsx scripts/check-cursor-sdk-runtime.ts
  • check:mcp-docspnpm exec tsx --import ./scripts/register-electron-mock.mjs scripts/generate-mcp-docs.ts --check
  • clipnpm exec tsx src/core/cli.ts
  • cli:buildpnpm exec tsx src/core/cli.ts build
  • cli:newpnpm exec tsx src/core/cli.ts new
  • cli:new-asset-packpnpm exec tsx src/core/cli.ts new-asset-pack
  • compilepnpm generate:build-config && run-cmd tsc --build tsconfig.json && run-cmd tsc -p tsconfig.preload.json
  • devpnpm compile && concurrently -k -n MAIN,PRELOAD "pnpm dev:main" "pnpm dev:preload" "pnpm dev:electron"
  • dev:electronpnpm prepare:native-deps && electron dist/src/electron/backend/main.js
  • dev:hostedpnpm compile && concurrently -k -n MAIN,PRELOAD "pnpm dev:main" "pnpm dev:preload" "dotenv -v DEV_HOSTED=true pnpm dev:electron"
  • dev:maintsc --watch -p tsconfig.json
  • dev:preloadtsc --watch -p tsconfig.preload.json
  • dev:watchpnpm compile && concurrently -k -n MAIN,PRELOAD "pnpm dev:main" "pnpm dev:preload" nodemon
  • distpnpm dist:live
  • dist:allpnpm dist:dev && pnpm dist:staging && pnpm dist:live
  • dist:devdotenv -v GENESYS_ENVIRONMENT=dev -- pnpm dist:electron
  • dist:electronpnpm build && pnpm prepare:native-deps && pnpm exec electron-builder --config electron-builder.config.mjs
  • dist:livedotenv -v GENESYS_ENVIRONMENT=live -- pnpm dist:electron
  • dist:stagingdotenv -v GENESYS_ENVIRONMENT=staging -- pnpm dist:electron
  • generate:build-configpnpm exec tsx scripts/generate-build-config.ts
  • generate:mcp-docspnpm exec tsx --import ./scripts/register-electron-mock.mjs scripts/generate-mcp-docs.ts
  • generate:template-scenespnpm exec tsx scripts/generate-template-scenes.ts
  • lintrun-cmd run-eslint .
  • mcp:inspectorpnpm exec tsx scripts/run-mcp-inspector.ts
  • packpnpm build && pnpm pack
  • postinstallpnpm exec tsx scripts/post-install.ts && pnpm generate:build-config
  • prepare:native-depspnpm rebuild sqlite3
  • testrun-cmd pnpm exec tsx --import ./scripts/register-electron-mock.mjs node_modules/qunit/bin/qunit.js test/**/*.test.ts
  • …and 1 more.
Dependencies34
  • @cursor/sdk1.0.18
  • @earendil-works/pi-agent-core^0.79.1
  • @earendil-works/pi-ai^0.79.1
  • @earendil-works/pi-coding-agent^0.79.1
  • @gltf-transform/core^4.3.0
  • @gltf-transform/extensions^4.3.0
  • @gltf-transform/functions^4.3.0
  • @gnsx/genesys.agent.embedded1.0.0
  • @gnsx/genesys.js11.3.3
  • @mcpc-tech/acp-ai-provider^0.3.3
  • @modelcontextprotocol/sdk^1.29.0
  • @sentry/electron^7.13.0
  • adm-zip^0.5.17
  • ai^6.0.177
  • chokidar^5.0.0
  • commander^14.0.3
  • cors^2.8.6
  • electron-devtools-installer^4.0.0
  • electron-is-dev^3.0.1
  • electron-log^5.4.4
  • electron-store^11.0.2
  • electron-updater^6.8.9
  • esbuild^0.28.0
  • express^5.2.1
  • fix-path^5.0.0
  • jsdom^27.4.0
  • meshoptimizer^1.1.1
  • minimatch^10.2.5
  • multer^2.1.1
  • threenpm:@gnsx/three@^0.184.18
  • …and 4 more.