registry / AI-agent control-surface risk / continuum-ai

continuum-ai

Persist and reuse work context across chats, projects, and tools via MCP and CLI

This report shows the evidence for continuum-ai@0.1.17. 5 of 13 known versions are blocked or flagged. The newest version, 1.0.0, is flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The global-install guard limits the trigger but does not make the mutation user-invoked. The package performs the policy-defined blocking behavior even though no network exfiltration was found.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm global install

Impact

Automatically grants Cursor access to this package's MCP tools and injects agent command prompts.

Mechanism

postinstall mutation of Cursor MCP configuration and commands

Policy narrative

During a global installation, postinstall calls Cursor setup automatically. The setup creates or overwrites the package-owned continuum entry in ~/.cursor/mcp.json and installs slash-command prompt files, causing Cursor to launch the bundled MCP server and expose its tools. This is an unconsented install-time mutation of a foreign, broad AI-agent control surface.

AI rationale

The global-install guard limits the trigger but does not make the mutation user-invoked. The package performs the policy-defined blocking behavior even though no network exfiltration was found.

Evidence

package.jsonscripts/postinstall.mjsdist/infrastructure/cursor/postinstall.jsdist/infrastructure/cursor/CursorMcpConfigWriter.jsdist/infrastructure/cursor/CursorCommandInstaller.js~/.cursor/mcp.json~/.cursor/commands/continuum-save.md~/.cursor/commands/continuum-load.md~/.cursor/commands/continuum-recap.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs a postinstall hook.
On global install, the hook invokes Cursor setup without a user command.
Setup writes ~/.cursor/mcp.json and installs Cursor slash-command files.

Evidence against

No HTTP client, remote URL, or credential-exfiltration path found in shipped JS.
The MCP entry points to the bundled local server, not a remote payload.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 97.9 KB of source

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

32"prepublishOnly": "npm run typecheck && npm run lint && npm test && npm run build", "postinstall": "node ./scripts/postinstall.mjs"

High

Suspicious Lifecycle Evidence

package.json runs a postinstall hook.

package.jsonView on unpkg · L32

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/infrastructure/config/packageVersion.jsView file

1import { createRequire } from 'node:module'; L2: const require = createRequire(import.meta.url); L3: export const PACKAGE_VERSION = require('../../../package.json').version;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infrastructure/config/packageVersion.jsView on unpkg · L1

dist/infrastructure/cursor/CursorMcpConfig.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L10: var nextEntry = buildContinuumMcpServerEntry(serverPath); L11: var existing = config.mcpServers?.[CONTINUUM_MCP_SERVER_NAME]; L12: if (existing !== undefined && entriesEqual(existing, nextEntry)) { ... L17: ...config, L18: mcpServers: { L19: ...config.mcpServers, L20: [CONTINUUM_MCP_SERVER_NAME]: nextEntry, Write operation from [redacted].js: L112: var commandsDir = resolveCursorCommandsDir(); L113: await mkdir(commandsDir, { recursive: true }); L114: var installed = []; Foreign user/project scope from [redacted].js: L1: import { homedir } from 'node:os'; L2: import { join } from 'node:path';

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/infrastructure/cursor/CursorMcpConfig.jsView on unpkg · L1

dist/presentation/cli/cli.jsView file

•matchType = normalized_sha256 matchedPackage = continuum-ai@0.1.15 matchedPath = dist/presentation/cli/cli.js matchedIdentity = npm:Y29udGludXVtLWFp:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/presentation/cli/cli.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

32"prepublishOnly": "npm run typecheck && npm run lint && npm test && npm run build", "postinstall": "node ./scripts/postinstall.mjs"

High

Suspicious Lifecycle Evidence

package.json runs a postinstall hook.

package.jsonView on unpkg · L32

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/infrastructure/config/packageVersion.jsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackdist/infrastructure/cursor/CursorMcpConfig.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similaritydist/presentation/cli/cli.js

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/infrastructure/config/packageVersion.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to continuum-ai@0.1.17.

The versions list below shows the verdict for each recorded version.

Avoid installing continuum-ai@0.1.17. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-13 20:46:31.453Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

13 known versions

1.0.0latestSuspiciousAgent extension lifecycle riskWarnPublishedAug 13, 2026, 10:29 PM 0.1.18SuspiciousAgent extension lifecycle riskWarnPublishedAug 13, 2026, 9:19 PM 0.1.17shownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 13, 2026, 8:38 PM 0.1.15MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 13, 2026, 5:36 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code