Loading npm security reports…

continuum-ai@0.1.17: AI-agent control-surface risk | LPM Firewall

registry / continuum-ai / 0.1.17

continuum-ai@0.1.17

Persist and reuse work context across chats, projects, and tools via MCP and CLI

AI Security Review

scanned 2d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically configures the unrelated Cursor AI-agent control surface. It registers the package’s local MCP server and adds slash commands without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

npm global install

Impact

Automatically grants Cursor access to this package's MCP tools and injects agent command prompts.

Mechanism

postinstall mutation of Cursor MCP configuration and commands

Policy narrative

During a global installation, postinstall calls Cursor setup automatically. The setup creates or overwrites the package-owned continuum entry in ~/.cursor/mcp.json and installs slash-command prompt files, causing Cursor to launch the bundled MCP server and expose its tools. This is an unconsented install-time mutation of a foreign, broad AI-agent control surface.

Rationale

The global-install guard limits the trigger but does not make the mutation user-invoked. The package performs the policy-defined blocking behavior even though no network exfiltration was found.

Evidence

package.jsonscripts/postinstall.mjsdist/infrastructure/cursor/postinstall.jsdist/infrastructure/cursor/CursorMcpConfigWriter.jsdist/infrastructure/cursor/CursorCommandInstaller.js~/.cursor/mcp.json~/.cursor/commands/continuum-save.md~/.cursor/commands/continuum-load.md

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

32"prepublishOnly": "npm run typecheck && npm run lint && npm test && npm run build", "postinstall": "node ./scripts/postinstall.mjs"

High

Suspicious Lifecycle Evidence

package.json runs a postinstall hook.

package.jsonView on unpkg · L32

•scripts.postinstall = node ./scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/infrastructure/config/packageVersion.jsView file

1import { createRequire } from 'node:module'; L2: const require = createRequire(import.meta.url); L3: export const PACKAGE_VERSION = require('../../../package.json').version;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/infrastructure/config/packageVersion.jsView on unpkg · L1

dist/infrastructure/cursor/CursorMcpConfig.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L10: var nextEntry = buildContinuumMcpServerEntry(serverPath); L11: var existing = config.mcpServers?.[CONTINUUM_MCP_SERVER_NAME]; L12: if (existing !== undefined && entriesEqual(existing, nextEntry)) { ... L17: ...config, L18: mcpServers: { L19: ...config.mcpServers, L20: [CONTINUUM_MCP_SERVER_NAME]: nextEntry, Write operation from [redacted].js: L112: var commandsDir = resolveCursorCommandsDir(); L113: await mkdir(commandsDir, { recursive: true }); L114: var installed = []; Foreign user/project scope from [redacted].js: L1: import { homedir } from 'node:os'; L2: import { join } from 'node:path';

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/infrastructure/cursor/CursorMcpConfig.jsView on unpkg · L1

dist/presentation/cli/cli.jsView file

•matchType = normalized_sha256 matchedPackage = continuum-ai@0.1.15 matchedPath = dist/presentation/cli/cli.js matchedIdentity = npm:Y29udGludXVtLWFp:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/presentation/cli/cli.jsView on unpkg

Source & flagged code

6 flagged

package.jsonView file

Lines 12-53json

12 "url": "https://github.com/allcantara/continuum-ai/issues"

13 },

14 "homepage": "https://github.com/allcantara/continuum-ai#readme",

15 "bin": {

16 "continuum": "dist/presentation/cli/cli.js",

17 "continuum-mcp": "dist/presentation/mcp/server.js"

18 },

19 "files": [

20 "dist",

21 "scripts"

22 ],

23 "scripts": {

24 "build": "tsc",

25 "dev": "tsx src/presentation/mcp/server.ts",

26 "start": "node dist/presentation/mcp/server.js",

27 "cli": "tsx src/presentation/cli/cli.ts",

28 "test": "vitest run",

29 "test:watch": "vitest",

30 "lint": "eslint src tests",

31 "typecheck": "tsc --noEmit",

32 "prepublishOnly": "npm run typecheck && npm run lint && npm test && npm run build",

33 "postinstall": "node ./scripts/postinstall.mjs"

High

Suspicious Lifecycle Evidence

package.json runs a postinstall hook.

package.jsonView on unpkg · L32

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L33

34 },

35 "engines": {

36 "node": ">=24.15.0"

37 },

38 "keywords": [

39 "mcp",

40 "context",

41 "memory",

42 "ai",

43 "cursor"

44 ],

45 "license": "MIT",

46 "dependencies": {

47 "@modelcontextprotocol/sdk": "^1.12.1",

48 "commander": "^13.1.0",

49 "zod": "^3.24.2"

50 },

51 "devDependencies": {

52 "@types/node": "^22.15.21",

53 "esbuild": "^0.28.2",

dist/infrastructure/config/packageVersion.jsView file

Lines 1-4javascript

1import { createRequire } from 'node:module';

2const require = createRequire(import.meta.url);

3export const PACKAGE_VERSION =

dist/infrastructure/cursor/CursorMcpConfig.jsView file

Lines 1-21javascript

1import { err, ok } from '../../application/Result.js';

2import { CONTINUUM_MCP_SERVER_NAME } from './CursorPaths.js';

3export function buildContinuumMcpServerEntry(serverPath) {

4 if (process.platform

dist/presentation/cli/cli.jsView file

•matchType = normalized_sha256 matchedPackage = continuum-ai@0.1.15 matchedPath = dist/presentation/cli/cli.js matchedIdentity = npm:Y29udGludXVtLWFp:0.1.15 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/presentation/cli/cli.jsView on unpkg