registry / AI-agent control-surface risk / langcli-com
langcli-com
Langcli - interactive AI coding assistant in the terminal
This report shows the evidence for langcli-com@0.1.50. 6 of 10 known versions are blocked or flagged. The newest version, 0.1.51, is flagged. See all versions.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has a concrete postinstall chain that automatically alters an MCP Chrome integration and invokes a permission-changing command. This meets the install-time foreign agent control-surface mutation block policy.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
npm postinstall during package installation.
Impact
Creates or alters a Chrome MCP agent control surface in the installing user's environment.
Mechanism
Automatic execution of MCP bridge permission and registration commands.
Policy narrative
The manifest runs scripts/setup-chrome-mcp.mjs automatically after installation. Unless an opt-out environment variable is already set, that script resolves and executes an external MCP bridge CLI, first requesting permission changes and then registering Chrome integration. This is an unconsented install-time change to an AI-agent/browser control surface, rather than a user-invoked setup action.
AI rationale
The package has a concrete postinstall chain that automatically alters an MCP Chrome integration and invokes a permission-changing command. This meets the install-time foreign agent control-surface mutation block policy.
Evidence
package.jsonscripts/setup-chrome-mcp.mjs
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 97.0% confidence with low false-positive risk.
Evidence for policy risk
- The postinstall hook automatically launches the Chrome MCP setup script.
- The setup script invokes a separate MCP bridge with fix-permissions and Chrome registration commands during installation.
Evidence against
- An environment variable can skip the setup, but it is opt-out rather than consent.
- The inspected setup script shows no direct remote endpoint or credential collection.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
NoLicense
Oversized source lightweight scan
dist/cli.js26.6 MB file, sampled 256 KB
FilesystemChildProcess
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/setup-chrome-mcp.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/setup-chrome-mcp.mjsView file
11import { execFileSync } from 'node:child_process'
L12: import { mkdirSync } from 'node:fs'
L13: import { createRequire } from 'node:module'
...
L16:
L17: if (process.env.CLAUDE_CODE_SKIP_CHROME_MCP_SETUP === '1') {
L18: process.exit(0)
...
L57:
L58: mkdirSync(getChromeMcpLogDir(), { recursive: true })
L59:
Critical
Ai Agent Control Hijack
Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/setup-chrome-mcp.mjsView on unpkg · L11•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
#!/usr/bin/env node
import { execfilesync } from 'node:child_process'
import { mkdirsync } from 'node:fs'
import { createrequire } from 'node:module'
import { homedir } from 'node:os'
import { join } from 'node:path'
if (process.env.claude_code_skip_chrome_mcp_setup === '1') {
process.exit(0)
}
const require = createrequire(import.meta.url)
const clipath = require.resolve(
'@claude-code-best/mcp-chrome-bridge/dist/cli.js',
)
const userargs = process.argv.
Findings
1 Critical3 High5 Medium6 Low
CriticalAi Agent Control Hijackscripts/setup-chrome-mcp.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighExternal Ai Agent Control Surface Mutationscripts/setup-chrome-mcp.mjs
HighKnown Malware Source Fingerprint Signaturescripts/setup-chrome-mcp.mjs
MediumEnvironment Vars
MediumShips Native Binarydist/vendor/audio-capture/x64-darwin/audio-capture.node
MediumOversized Source Filedist/cli.js
MediumOversized Cli Entrypointdist/cli.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to langcli-com@0.1.50.
The versions list below shows the verdict for each recorded version.
- Avoid installing langcli-com@0.1.50. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
10 known versions0.1.51latestSuspiciousAgent extension lifecycle riskWarnPublishedOct 9, 2026, 9:16 AM0.1.50shownMaliciousSoft block: AI-agent control surfaceBlockPublishedSep 10, 2026, 9:20 AM0.1.49MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 7, 2026, 7:35 AM0.1.48MaliciousSoft block: AI-agent control surfaceBlockPublishedSep 3, 2026, 11:48 AM