Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Question

Cursor added an npm package I can't find on GitHub, safe to install?

Solved · 1203 views · asked by valentina_s · edited
cursorsecuritynode

Cursor wants me to install next-supabase-session-helper for my auth. npm install works, but the package has no GitHub link, 2 versions, and was published 3 weeks ago. The code Cursor wrote uses functions from it.

Am I being paranoid?

What I’ve tried

Looked at the npm page, the readme is one line. Asked Cursor where it came from and it said it's 'a popular package for this use case'.

Comment
Don't run anything else with it yet. Answer coming. lena_ops · edited

3 answers

Marked as helpful by the asker
lena_ops · edited

Not paranoid. Uninstall it.

AI models regularly invent package names that sound plausible. Attackers watch for commonly hallucinated names and register them with malicious code (install scripts that steal env vars, tokens, SSH keys). This is called slopsquatting. A brand-new package with no repo and a one-line readme is the exact profile.

  1. npm uninstall next-supabase-session-helper
  2. If it ran an install script: rotate the keys in your .env files, to be safe.
  3. Use the official @supabase/ssr package; that's what the Supabase Next.js guide uses.

Before installing anything an AI suggests: repo link, weekly downloads, age, maintainer. If any of those look off, ask for a solution with the packages you already have.

Comment
Good addition, with the caveat that a few legit packages need their postinstall. lena_ops · edited
Removed, rotated my keys, switched to @supabase/ssr. Thank you, genuinely scary. valentina_s · edited
Also set ignore-scripts=true in .npmrc for projects where you let an agent install things. Blocks the most common payload route. chidi_eze · edited
amir_h · edited

One more habit: add to your rules "Do not add dependencies without asking. Name the package, its weekly downloads and repo." It forces the check to happen before the install.

Comment
Added this to my rules file. Makes sense. valentina_s · edited
sven_fire · edited

Before installing, npm view <package> shows publish date, maintainers and repository in the terminal. Takes 5 seconds and would have flagged this one.

Comment

Related

Webhook signature verification always fails in my Express serversolved
express-rate-limit throws ValidationError about X-Forwarded-For on Replit3 ans.
Windsurf ran rm -rf node_modules and a full reinstall without asking me3 ans.
People can get the paid feature by just going to /successsolved
Users can make themselves admin by editing their own Firestore documentsolved

Your answer

Sign in to write an answer