LWA-2026-10888 confirmed malware
@darshanpatel2608/cursor-dash@1.0.0
Malicious code in @darshanpatel2608/cursor-dash (npm)
T1552.001 · Credentials In FilesT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols
Analysis
The package's optional cloud-sync feature reads the local Cursor IDE auth token from Cursor's on-disk SQLite database (key 'cursorAuth/accessToken') and transmits it over HTTP to the remote endpoint hxxps://api2[.]cursor[.]sh/aiserver[.]v1[.]DashboardService/GetUsageBasedPremiumRequests, placing the token in the Authorization: Bearer header of the POST request. The token is read from the user's local Cursor installation and sent to a network destination.
- analyzed by
- Leitwacht
- first seen
- Aug 9, 2026, 08:24 PM
- analyzed
- Aug 9, 2026, 08:25 PM
Related advisories
- simple-date-formatter-new-10@1.0.0
- cryptostock@1.0.0
- kit-map-streak@1.0.0
- streak-map-kit@1.0.0
- @fedfub/string-utils@1.0.0
- streak-kit-map@1.0.0
- weight2loss@1.0.5
- gpt-terminal-cli@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.