Is Cursor Cat safe?

Question

Is Cursor Cat safe?

Accepted Answer

Cursor Cat is high risk. We observed a POST to https://events.givefreely.com/popup whose recorded body included eventData.userId=fcff436a-0490-4684-8d65-aabf39050923. The shipped background code creates or updates a GiveFreely anonymous user, stores the returned X-AnonymousUserToken and user record locally, and adds the same userId to analytics events; offer activation also sends the userId, selected-charity fields, merchant identifiers, and the page URL to a configured activation endpoint. Cursor Cat starts a GiveFreely integration with the partner key `cursorcatprod` and fetches behavioral configuration from `cdn.givefreely.com`. The returned JSON supplies merchant matching data, analytics and affiliate endpoints, Wildfire API settings, refresh timing, and URL policy fields that the extension later uses for popup, event, and affiliate-link decisions.

Is Cursor Cat safe?

Findings