Loading npm security reports…

continuum-ai@0.1.12: AI-agent control-surface risk | LPM Firewall

registry / continuum-ai / 0.1.12

continuum-ai@0.1.12

Persist and reuse work context across chats, projects, and tools via MCP and CLI

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically configures Cursor to launch this package's MCP server and adds Cursor command files. This mutates a user-wide AI-agent control surface without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm global installation, invoking postinstall

Impact

Cursor may load the package MCP server and its installed slash commands after reload.

Mechanism

postinstall writes ~/.cursor/mcp.json and ~/.cursor/commands entries

Policy narrative

Installing the package globally triggers postinstall. The hook invokes Cursor setup, which creates or updates the user's ~/.cursor/mcp.json to register the bundled Continuum MCP server and writes managed slash-command files under ~/.cursor/commands. On Cursor reload, this makes the package's MCP server available through the user's agent environment. No exfiltration endpoint was found, but the unconsented install-time mutation of a broad external AI-agent control surface is concrete.

Rationale

The package performs unconsented postinstall configuration of Cursor's user-wide MCP and command surfaces. This meets the install-control-surface block policy despite the global-install guard.

Evidence

package.jsonscripts/postinstall.mjsdist/infrastructure/cursor/postinstall.jsdist/infrastructure/cursor/CursorPaths.jsdist/infrastructure/cursor/CursorMcpConfigWriter.jsdist/infrastructure/cursor/CursorCommandInstaller.js~/.cursor/mcp.json

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/infrastructure/config/packageVersion.jsView file

1import { createRequire } from 'node:module'; L2: const require = createRequire(import.meta.url); L3: export const PACKAGE_VERSION = require('../../../package.json').version;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infrastructure/config/packageVersion.jsView on unpkg · L1

dist/infrastructure/cursor/CursorMcpConfig.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L10: var nextEntry = buildContinuumMcpServerEntry(serverPath); L11: var existing = config.mcpServers?.[CONTINUUM_MCP_SERVER_NAME]; L12: if (existing !== undefined && entriesEqual(existing, nextEntry)) { ... L17: ...config, L18: mcpServers: { L19: ...config.mcpServers, L20: [CONTINUUM_MCP_SERVER_NAME]: nextEntry, Write operation from [redacted].js: L138: var commandsDir = resolveCursorCommandsDir(); L139: await mkdir(commandsDir, { recursive: true }); L140: var installed = []; Foreign user/project scope from [redacted].js: L1: import { homedir } from 'node:os'; L2: import { join } from 'node:path';

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/infrastructure/cursor/CursorMcpConfig.jsView on unpkg · L1

dist/infrastructure/cursor/postinstall.jsView file

3async function main() { if (!isNpmGlobalInstall()) { return; } var result = await setupCursor();

High

Suspicious Lifecycle Evidence

postinstall runs a Cursor setup routine on global npm installation.

dist/infrastructure/cursor/postinstall.jsView on unpkg · L3

dist/infrastructure/cursor/CursorMcpConfigWriter.jsView file

18var merged = mergeContinuumMcpServer(config, serverPath); if (!merged.updated && await fileExists(configPath)) { return ok({ configPath, updated: false }); } var content = `${JSON.stringify(merged.config, null, 4)}\n`; await writeFileAtomically(configPath, content); return ok({ configPath, updated: merged.updated });

High

Ai Review Evidence

Setup creates/updates Cursor MCP configuration during installation.

dist/infrastructure/cursor/CursorMcpConfigWriter.jsView on unpkg · L18

Source & flagged code

6 flagged

package.jsonView file

Lines 13-53json

13 },

14 "homepage": "https://github.com/allcantara/continuum-ai#readme",

15 "bin": {

16 "continuum": "dist/presentation/cli/cli.js",

17 "continuum-mcp": "dist/presentation/mcp/server.js"

18 },

19 "files": [

20 "dist",

21 "scripts"

22 ],

23 "scripts": {

24 "build": "tsc",

25 "dev": "tsx src/presentation/mcp/server.ts",

26 "start": "node dist/presentation/mcp/server.js",

27 "cli": "tsx src/presentation/cli/cli.ts",

28 "test": "vitest run",

29 "test:watch": "vitest",

30 "lint": "eslint src tests",

31 "typecheck": "tsc --noEmit",

32 "prepublishOnly": "npm run typecheck && npm run lint && npm test && npm run build",

33 "postinstall": "node ./scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "engines": {

36 "node": ">=24.15.0"

37 },

38 "keywords": [

39 "mcp",

40 "context",

41 "memory",

42 "ai",

43 "cursor"

44 ],

45 "license": "MIT",

46 "dependencies": {

47 "@modelcontextprotocol/sdk": "^1.12.1",

48 "commander": "^13.1.0",

49 "zod": "^3.24.2"

50 },

51 "devDependencies": {

52 "@types/node": "^22.15.21",

53 "esbuild": "^0.28.2",

dist/infrastructure/config/packageVersion.jsView file

Lines 1-4javascript

1import { createRequire } from 'node:module';

2const require = createRequire(import.meta.url);

3export const PACKAGE_VERSION =

dist/infrastructure/cursor/CursorMcpConfig.jsView file

Lines 1-21javascript

1import { err, ok } from '../../application/Result.js';

2import { CONTINUUM_MCP_SERVER_NAME } from './CursorPaths.js';

3export function buildContinuumMcpServerEntry(serverPath) {

4 if (process.platform

dist/infrastructure/cursor/postinstall.jsView file

Lines 1-23javascript

1import { setupCursor } from '../../application/setup/SetupCursorUseCase.js';

2import { isNpmGlobalInstall } from '../npm/isNpmGlobalInstall.js';

3async function main() {

4 if (!isNpmGlobalInstall

dist/infrastructure/cursor/CursorMcpConfigWriter.jsView file

Lines 1-35javascript

1import { access, mkdir, readFile } from 'node:fs/promises';

2import { ok } from '../../application/Result.js';

3import { writeFileAtomically } from '../persistence/filesystem/AtomicFileWriter.js';

4import { resolveCursorHome, resolveCursorMcpConfigPath } from