
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
cursor-hook
Advanced tools
A TypeScript CLI tool to install Cursor hooks from Git repositories.
npm install -g cursor-hook
# or
npx cursor-hook install <repository>
cursor-hook install <repository-or-path>
The tool supports multiple repository reference formats and local paths:
Git Repositories:
beautyfree/cursor-window-activate-hookgithub.com/beautyfree/cursor-window-activate-hookgitlab.com/owner/repohttps://github.com/owner/repo.git or git@github.com:owner/repo.gitLocal Paths:
/path/to/local/repo./local-repo or ../parent/repo# Install from GitHub repository
npx cursor-hook install beautyfree/cursor-window-activate-hook
# Install from local directory
npx cursor-hook install ./cursor-window-activate-hook
npx cursor-hook install /Users/me/projects/my-hook
Repositories must include a cursor-hook.config.json file in the repository root. The CLI loads it after cloning or when using a local path.
When the installation command is the same across all platforms, use a simple string:
{
"installCommand": "npm install --production --no-save --silent --no-audit --no-fund || true",
"files": {
"hooks": ["activate-window"],
"rules": []
},
"hooks": {
"beforeSubmitPrompt": [
{
"command": "node $HOME/.cursor/hooks/activate-window/activate-window.js"
}
]
}
}
For system-wide dependencies only (e.g. xdotool), use systemInstallCommand (runs once):
{
"systemInstallCommand": {
"linux": "sudo apt-get install -y xdotool || sudo yum install -y xdotool || true",
"macos": "",
"windows": "",
"default": "echo 'No installation needed for this platform'"
},
"files": { "hooks": ["file1.sh"], "rules": [] },
"hooks": { ... }
}
When you need both system deps (run once) and per-hook build (e.g. npm i && npm run build in each hook folder), use systemInstallCommand and installCommand:
{
"systemInstallCommand": {
"linux": "sudo apt-get install -y xdotool || sudo yum install -y xdotool || true",
"macos": "",
"windows": "",
"default": "echo 'No system install needed'"
},
"installCommand": "npm i --no-save --silent && npm run build || true",
"files": {
"hooks": ["hooks/docs", "hooks/activate"],
"rules": []
},
"hooks": {
"afterFileEdit": [{ "command": "node $HOME/.cursor/hooks/docs/dist/docs.js" }],
"stop": [{ "command": "node $HOME/.cursor/hooks/activate/dist/activate.js" }]
}
}
Order: 1) systemInstallCommand runs once from hooks dir. 2) installCommand runs in each hook folder (docs, activate).
You can require the user to provide environment variables during install. Values are injected into the hook command (no .env file). The CLI prepends VAR=value (Unix) or set "VAR=value" && (Windows) so the hook process receives the variables.
You can set requiredEnv in two places:
{
"requiredEnv": ["API_KEY", { "name": "SECRET", "description": "Optional hint" }],
"hooks": {
"afterFileEdit": [{ "command": "node $HOME/.cursor/hooks/docs/docs.js" }]
}
}
{
"hooks": {
"afterFileEdit": [
{ "command": "node $HOME/.cursor/hooks/docs/docs.js", "requiredEnv": ["API_KEY"] }
],
"beforeSubmitPrompt": [
{ "command": "node $HOME/.cursor/hooks/activate/activate.js", "requiredEnv": ["SECRET_TOKEN", "API_URL"] }
]
}
}
process.env is used as default. Only the vars required by that hook are injected into each command (e.g. the beforeSubmitPrompt command above gets only SECRET_TOKEN and API_URL).installCommand.{ "name", "description?" }) to prompt for; applied to all hooks that don’t set their own requiredEnv. Values are injected into the hook command in hooks.json..cursor/hooks.cursor/rules (Cursor Rules for AI)"afterFileEdit": [{ "command": "node $HOME/.cursor/hooks/docs/dist/docs.js", "requiredEnv": ["API_KEY"] }]Path behavior: Paths in files.hooks and files.rules are relative to the repository root. Each item is copied into the target dir using its last path segment (e.g. hooks/docs → .../.cursor/hooks/docs). If a target path already exists, the CLI will prompt before overwriting.
Install command cwd: installCommand runs with the current working directory set to each hook folder (or to the hooks dir if there are no hook folders). Do not put cd <path> in the command—use only the build steps (e.g. npm i && npm run build || true).
cursor-hook.config.json from the repository root~/.cursor/hooks.json (applies to all projects).cursor/hooks.json (applies to current project only)hooks.json.files.hooks → .cursor/hooks, files.rules → .cursor/rules (if present)hooks.json (if present)hooks.json (preserves existing hooks, prevents duplicates)The tool works on:
Path variables like $HOME are automatically expanded on all platforms.
If you are implementing a hook script (e.g. in Node.js) and want typed payloads, install the package and import types:
npm install cursor-hook
import type { AfterFileEditPayload, HookEventName } from 'cursor-hook';
See Cursor Hooks documentation for payload and response schemas. The package re-exports TypeScript types that match those schemas.
See cursor-window-activate-hook for a complete example of a hook repository with:
cursor-hook.config.json configuration fileThis repository demonstrates:
hooks.json.backup if hooks.json exists. To restore: copy the backup over hooks.json..../hooks/docs) already exist, the CLI asks for confirmation before overwriting.# Install dependencies
npm install
# Build
npm run build
# Run in development mode
npm run dev install <repository>
MIT
FAQs
CLI tool to install Cursor hooks
The npm package cursor-hook receives a total of 16 weekly downloads. As such, cursor-hook popularity was classified as not popular.
We found that cursor-hook demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.