cursor-nightly-bin

maintainer augusdogus · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb binary from a non-whitelisted host (downloads.cursor.com), which is not inherently malicious but presents a supply-chain risk if the host were compromised or the download redirected, especially with a SKIP'd checksum for the primary source.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "cursor_${_upstream_pkgver}_amd64.deb::https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${_upstream_pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted host (downloads.cursor.com), which is not inherently malicious but presents a supply-chain risk if the host were compromised or the download redirected, especially with a SKIP'd checksum for the primary source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AugusDogus <augie@linux.com>
    
      2
    
      3pkgname=cursor-nightly-bin
    
      4pkgver=3.14.4
    
      5_upstream_pkgver=3.14.4
    
      6pkgrel=1
    
      7pkgdesc='AI-first coding environment (nightly channel, bundled Electron)'
    
      8arch=('x86_64')
    
      9url="https://www.cursor.com"
    
      10license=('LicenseRef-Cursor_EULA')
    
      11provides=('cursor')
    
      12conflicts=('cursor-bin' 'cursor-early-access-bin' 'cursor-ide-bin')
    
      13depends=(
    
      14  'alsa-lib'
    
      15  'dbus'
    
      16  'gcc-libs'
    
      17  'gtk3'
    
      18  'libdrm'
    
      19  'libsecret'
    
      20  'libxkbfile'
    
      21  'mesa'
    
      22  'nss'
    
      23  'xdg-utils'
    
      24)
    
      25optdepends=(
    
      26  'libnotify: desktop notifications'
    
      27  'org.freedesktop.secrets: credential storage via SecretService'
    
      28  'libdbusmenu-glib: KDE global menu support'
    
      29)
    
      30options=(!strip !debug)
    
      31_commit=149074cca1ff4c3b41ef1224c95188cea44ec413
    
      32source=(
    
      33  "cursor_${_upstream_pkgver}_amd64.deb::https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${_upstream_pkgver}_amd64.deb"
    
      34  cursor.desktop
    
      35  cursor-launcher.sh
    
      36)
    
      37sha512sums=('SKIP'
    
      38  '037aa5d878eddb06fc1d5be788e7bc64545773decacb34228053be746dfc33237371ad49cc331dac8e3437d7d885a9bc1564d0f114fc22e308827b33d0c55ad8'
    
      39  '9defecd35fd033a484642732605264cc00faf5791d852234d9705bf9ac005c76173780cd496208e4150685ac9ddbb73c8eb87cd5141526dd4521d455342e8233')
    
      40sha512sums[0]=ea7651608d6293c1003fc320d767bbcdf826981ae4b2e18a8dd86e6716f9707c0bf3ab12fa01783f09f7d50bea1119d806d453567f48686652716e03e2beb733
    
      41noextract=("cursor_${_upstream_pkgver}_amd64.deb")
    
      42
    
      43package() {
    
      44  # Extract full deb — keep bundled Electron intact.
    
      45  bsdtar -xOf "cursor_${_upstream_pkgver}_amd64.deb" data.tar.xz |
    
      46    tar -xJf - -C "$pkgdir"
    
      47
    
      48  # Fix zsh completion path for Arch
    
      49  if [[ -d "$pkgdir/usr/share/zsh/vendor-completions" ]]; then
    
      50    mv "$pkgdir/usr/share/zsh/vendor-completions" \
    
      51       "$pkgdir/usr/share/zsh/site-functions"
    
      52  fi
    
      53
    
      54  install -Dm644 "$srcdir/cursor.desktop" \
    
      55    "$pkgdir/usr/share/applications/cursor.desktop"
    
      56
    
      57  install -Dm755 "$srcdir/cursor-launcher.sh" "$pkgdir/usr/bin/cursor"
    
      58
    
      59  _license="$pkgdir/usr/share/cursor/resources/app/LICENSE.txt"
    
      60  if [[ ! -f "$_license" ]]; then
    
      61    _license=$(find "$pkgdir/usr/share/cursor" -maxdepth 8 -type f \( -name 'LICENSE.txt' -o -name 'LICENSE' \) -print -quit 2>/dev/null)
    
      62  fi
    
      63  if [[ -f "$_license" ]]; then
    
      64    install -Dm644 "$_license" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      65  else
    
      66    echo "Warning: Cursor license file not found in .deb; skipping /usr/share/licenses install" >&2
    
      67  fi
    
      68
    
      69  if [[ -f "$pkgdir/usr/share/cursor/chrome-sandbox" ]]; then
    
      70    chmod 4755 "$pkgdir/usr/share/cursor/chrome-sandbox"
    
      71  fi
    
      72}
    
      73
    
      74
    
      75
    
      76
    
      77
    
      78
    
      79
    
      80
    
      81
    
      82
    
      83
    
      84
    
      85
    
      86
    
      87
    
      88
    
      89
    
      90
    
      91
    
      92
    
      93
    
      94
    
      95
    
      96
    
      97
    
      98
    
      99
    
      100
    
      101
    
      102
    
      103
    
      104
    
      105
    
      106
    
      107
    
      108
    
      109
    
      110
    
      111
    
      112
    
      113
    
      114
    
      115
    
      116
    
      117
    
      118
    
      119
    
      120
    
      121
    
      122
    
      123
    
      124
    
      125
    
      126
    
      127
    
      128
    
      129
    
      130
    
      131
    
      132
    
      133
    
      134
    
      135
    
      136
    
      137
    
      138
    
      139
    
      140
    
      141
    
      142
    
      143
    
      144
    
      145
    
      146
    
      147
    
      148
    
      149
    
      150
    
      151
    
      152
    
      153
    
      154
    
      155
    
      156
    
      157
    
      158
    
      159
    
      160
    
      161
    
      162
    
      163
    
      164
    
      165
    
      166
    
      167
    
      168

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,8 +1,8 @@
 # Maintainer: AugusDogus <augie@linux.com>
 
 pkgname=cursor-nightly-bin
-pkgver=3.13.25
-_upstream_pkgver=3.13.25
+pkgver=3.14.4
+_upstream_pkgver=3.14.4
 pkgrel=1
 pkgdesc='AI-first coding environment (nightly channel, bundled Electron)'
 arch=('x86_64')
@@ -28,7 +28,7 @@
   'libdbusmenu-glib: KDE global menu support'
 )
 options=(!strip !debug)
-_commit=31e8d61c448c7472e371505838a0fe34083dad55
+_commit=149074cca1ff4c3b41ef1224c95188cea44ec413
 source=(
   "cursor_${_upstream_pkgver}_amd64.deb::https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${_upstream_pkgver}_amd64.deb"
   cursor.desktop
@@ -37,7 +37,7 @@
 sha512sums=('SKIP'
   '037aa5d878eddb06fc1d5be788e7bc64545773decacb34228053be746dfc33237371ad49cc331dac8e3437d7d885a9bc1564d0f114fc22e308827b33d0c55ad8'
   '9defecd35fd033a484642732605264cc00faf5791d852234d9705bf9ac005c76173780cd496208e4150685ac9ddbb73c8eb87cd5141526dd4521d455342e8233')
-sha512sums[0]=f750e522d8fc6abcdc41fb4da0b567470a5542f283f5c2eb8e861f1ae55ee08c55ec6b4597b7f907606c47a34800e4c01d3284291f8bf31fbd7a6160ce02292e
+sha512sums[0]=ea7651608d6293c1003fc320d767bbcdf826981ae4b2e18a8dd86e6716f9707c0bf3ab12fa01783f09f7d50bea1119d806d453567f48686652716e03e2beb733
 noextract=("cursor_${_upstream_pkgver}_amd64.deb")
 
 package() {
@@ -164,3 +164,5 @@
 
 
 
+
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 05:17:13	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 05:14:03	MEDIUM	2
2026-07-30 00:17:23	LOW	2
2026-07-29 05:10:22	MEDIUM	1
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 09:37:42	MEDIUM	2
2026-07-28 03:37:00	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 05:34:42	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 05:29:17	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 03:27:03	MEDIUM	2
2026-07-24 00:02:28	LOW	2
2026-07-23 05:22:32	MEDIUM	1