Loading npm security reports…

local-mcp@3.0.348: AI-agent control-surface risk | LPM Firewall

registry / local-mcp / 3.0.348

local-mcp@3.0.348

Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.

AI Security Review

scanned 21d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install silently configures multiple third-party AI clients to launch this package, installs a tray LaunchAgent, and fetches executable payloads. The fetched runtime is selected by a backend response and is not integrity-pinned in package source.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm global install on macOS; postinstall automatically runs setup.

Impact

Third-party AI clients auto-start a remotely supplied local MCP server with broad local automation capability.

Mechanism

postinstall-driven MCP config injection, remote binary execution, and LaunchAgent persistence

Policy narrative

On global macOS installation, the postinstall hook runs setup without an explicit setup command. Setup detects and rewrites configurations for several unrelated AI clients so they launch local-mcp, downloads executable archives selected by a backend, then creates a persistent tray LaunchAgent and may open the client. The source removes quarantine and may ad-hoc-sign the downloaded executables, with no source-visible hash or signature pinning.

Rationale

This is unconsented install-time mutation of broad third-party AI-agent control surfaces, coupled to remote executable delivery and persistence. The skips and uninstall behavior do not remove the automatic global-install trigger.

Evidence

package.jsonpostinstall.jssetup.jsdownload.jsindex.js~/Library/Application Support/Claude/claude_desktop_config.json~/.cursor/mcp.json~/.codeium/windsurf/mcp_config.json

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

download.jsView file

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar'

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.jsView on unpkg · L7

351Trigger-reachable chain: manifest.main -> index.js -> download.js L351: if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) { L352: try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ } L353: } ... L364: L365: const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz` L366: process.stderr.write(`\nDescargando tray v${version}...\n`) L367:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

download.jsView on unpkg · L351

•matchType = previous_version_dangerous_delta matchedPackage = local-mcp@3.0.331 matchedIdentity = npm:bG9jYWwtbWNw:3.0.331 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

download.jsView on unpkg

12const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14:

High

Child Process

Package source references child process execution.

download.jsView on unpkg · L12

351if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) { L352: try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ } L353: } ... L364: L365: const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz` L366: process.stderr.write(`\nDescargando tray v${version}...\n`) L367:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

download.jsView on unpkg · L351

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L17: function extractTar(tarPath, destDir) { L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar' ... L30: const CACHE_DIR = process.platform === 'win32' L31: ? path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'local-mcp', 'bin')

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

download.jsView on unpkg · L7

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L17: function extractTar(tarPath, destDir) { L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar' ... L30: const CACHE_DIR = process.platform === 'win32' L31: ? path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'local-mcp', 'bin')

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

download.jsView on unpkg · L7

Lines 331-371javascript

331 // and only the durable one survives to stop a resurrection loop (FB-D1FA79).

332 const uninstalledMarkers = [

333 path.join(CACHE_DIR, '..', '.uninstalled'),

334 path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled'),

335 ]

336 if (uninstalledMarkers.some((p) => { try { return fs.existsSync(p) } catch { return false } })) return null

337

338 const info = await getLatestBinary()

339 const version = info.version

340 const trayApp = TRAY_APP

341 const verFile = path.join(TRAY_DIR, '.version')

342

343 // Migrar instalación vieja de ~/.local/share si existe

344 const oldTrayApp = path.join(TRAY_DIR, 'LocalMCPTray.app')

345 if (fs.existsSync(oldTrayApp)) {

346 try { execFileSync('rm', ['-rf', oldTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

347 }

348

349 // Migrar instalación vieja de /Applications → ~/Applications (evita diálogo App Management)

350 const systemTrayApp = '/Applications/LocalMCPTray.app'

351 if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) {

352 try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

353 }

354

355 // Ya instalado y actualizado

356 if (fs.existsSync(trayApp) && fs.existsSync(verFile)) {

357 if (fs.readFileSync(verFile, 'utf8').trim() === version) return trayApp

358 }

359

360 // In an active MCP session (non-TTY) the tray is running and self-updates via UpdateManager.

361 // Downloading a new tray bundle and rm-rf'ing the old one mid-session kills the Unix socket

362 // that local-mcp-server uses, crashing the session. Skip the update; it'll apply next login.

363 if (!process.stdin.isTTY && fs.existsSync(trayApp)) return trayApp

364

365 const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz`

366 process.stderr.write(`\nDescargando tray v${version}...\n`)

367

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

download.jsView on unpkg · L351

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

download.jsView on unpkg · L351

368 fs.mkdirSync(TRAY_DIR, { recursive: true })

369 const tarPath = path.join(TRAY_DIR, `tray-${version}.tar.gz`)

370

371 // Descargar ANTES de borrar el viejo — si la descarga falla, el tray actual sigue intacto