Loading npm security reports…

local-mcp@3.0.366: AI-agent control-surface risk | LPM Firewall

registry / local-mcp / 3.0.366

local-mcp@3.0.366

Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm postinstall automatically discovers and mutates third-party AI-client MCP configuration, causing those clients to run this package via npx. It also downloads remote native components and persists a tray application through a LaunchAgent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

`npm install -g local-mcp` on macOS when a supported AI client is detected.

Impact

Unconsented activation of a locally privileged MCP server in multiple AI clients; backend-controlled native payloads can execute and persist at login.

Mechanism

postinstall AI-agent configuration injection, remote native payload download, and LaunchAgent persistence

Policy narrative

On global macOS installation, the postinstall hook invokes setup in all-client mode without prompting. Setup detects installed AI clients and writes their MCP configs to launch `npx -y local-mcp@latest`, replacing `office-mcp` in standard MCP config layouts. The setup/runtime path retrieves native archives from package-controlled endpoints, extracts and executes them without content verification, and installs a KeepAlive LaunchAgent for the tray.

Rationale

This is an unconsented npm postinstall mutation of broad, foreign AI-agent control surfaces, coupled with unverified remote native payload execution and persistence. It meets the firewall block boundary.

Evidence

package.jsonpostinstall.jssetup.jsdownload.jsindex.js~/Library/Application Support/Claude/claude_desktop_config.json

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L7: * local-mcp setup → configura todos los clientes detectados L8: * local-mcp setup --all → configura todos sin preguntar L9: */ ... L13: const os = require('os') L14: const { execSync, execFileSync } = require('child_process') L15: ... L60: ' # curl telemetry — no Node dependency, fire-and-forget', L61: ` curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`, L62: ' -H "Content-Type: application/json" \\', L63: ' -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &', L64: ' printf \'LMCP requires Node 16+. Current

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

download.jsView file

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar'

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.jsView on unpkg · L7

•matchType = previous_version_dangerous_delta matchedPackage = local-mcp@3.0.331 matchedIdentity = npm:bG9jYWwtbWNw:3.0.331 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

download.jsView on unpkg

12const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14:

High

Child Process

Package source references child process execution.

download.jsView on unpkg · L12

351if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) { L352: try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ } L353: } ... L364: L365: const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz` L366: process.stderr.write(`\nDescargando tray v${version}...\n`) L367:

setup.jsView file

40// Write a .cmd wrapper that Claude Desktop can execute L41: fs.mkdirSync(cacheDir, { recursive: true }) L42: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') L43: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest %*\r\n` L44: fs.writeFileSync(cmdPath, script) L45: return cmdPath ... L50: try { L51: fs.mkdirSync(cacheDir, { recursive: true }) L52: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L68: ].join('\n') + '\n' L69: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L70: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.364 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.jsView on unpkg

index.jsView file

14Trigger-reachable persistence chain: manifest.main -> index.js L14: L15: const { spawn, execFileSync, execSync } = require('child_process') L16: const path = require('path') ... L18: const fs = require('fs') L19: const https = require('https') L20: ... L35: const list = [path.join(path.dirname(CACHE_DIR), '.uninstalled')] L36: if (process.platform === 'darwin') { L37: list.push(path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled')) L38: } ... L68: 'Then restart Claude Desktop / Cursor.' L69: process.stderr.write(msg + '\n')

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

index.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.364 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "local-mcp",

3 "version": "3.0.366",

4 "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.",

5 "main": "index.js",

6 "bin": {

7 "local-mcp": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "index.js",

14 "download.js",

15 "setup.js",

16 "postinstall.js",

17 "README.md"

18 ],

19 "engines": {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

20 "node": ">=18"

21 },

22 "os": [

23 "darwin"

24 ],

25 "keywords": [

26 "mcp",

27 "model-context-protocol",

28 "mcp-server",

29 "claude",

30 "claude-desktop",

download.jsView file

Lines 1-32javascript

1'use strict'

2/**

3 * download.js — descarga y cachea el binario standalone de LMCP desde R2.

4 * El binario fue compilado con PyInstaller — no requiere Python instalado.

5 * Cache: ~/.local/share/local-mcp/bin/{version}/

6 */

7

8const https = require('https')

setup.jsView file

40// Write a .cmd wrapper that Claude Desktop can execute L41: fs.mkdirSync(cacheDir, { recursive: true }) L42: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') L43: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest %*\r\n` L44: fs.writeFileSync(cmdPath, script) L45: return cmdPath ... L50: try { L51: fs.mkdirSync(cacheDir, { recursive: true }) L52: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L68: ].join('\n') + '\n' L69: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L70: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.364 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.jsView on unpkg

index.jsView file

14Trigger-reachable persistence chain: manifest.main -> index.js L14: L15: const { spawn, execFileSync, execSync } = require('child_process') L16: const path = require('path') ... L18: const fs = require('fs') L19: const https = require('https') L20: ... L35: const list = [path.join(path.dirname(CACHE_DIR), '.uninstalled')] L36: if (process.platform === 'darwin') { L37: list.push(path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled')) L38: } ... L68: 'Then restart Claude Desktop / Cursor.' L69: process.stderr.write(msg + '\n')

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

index.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.364 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.364 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Lines 331-371javascript

331 // and only the durable one survives to stop a resurrection loop (FB-D1FA79).

332 const uninstalledMarkers = [

333 path.join(CACHE_DIR, '..', '.uninstalled'),

334 path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled'),

335 ]

336 if (uninstalledMarkers.some((p) => { try { return fs.existsSync(p) } catch { return false } })) return null

337

338 const info = await getLatestBinary()

339 const version = info.version

340 const trayApp = TRAY_APP

341 const verFile = path.join(TRAY_DIR, '.version')

342

343 // Migrar instalación vieja de ~/.local/share si existe

344 const oldTrayApp = path.join(TRAY_DIR, 'LocalMCPTray.app')

345 if (fs.existsSync(oldTrayApp)) {

346 try { execFileSync('rm', ['-rf', oldTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

347 }

348

349 // Migrar instalación vieja de /Applications → ~/Applications (evita diálogo App Management)

350 const systemTrayApp = '/Applications/LocalMCPTray.app'

351 if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) {

352 try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

353 }

354

355 // Ya instalado y actualizado

356 if (fs.existsSync(trayApp) && fs.existsSync(verFile)) {

357 if (fs.readFileSync(verFile, 'utf8').trim() === version) return trayApp

358 }

359

360 // In an active MCP session (non-TTY) the tray is running and self-updates via UpdateManager.

361 // Downloading a new tray bundle and rm-rf'ing the old one mid-session kills the Unix socket

362 // that local-mcp-server uses, crashing the session. Skip the update; it'll apply next login.

363 if (!process.stdin.isTTY && fs.existsSync(trayApp)) return trayApp

364

365 const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz`

366 process.stderr.write(`\nDescargando tray v${version}...\n`)

367

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

download.jsView on unpkg · L351

368 fs.mkdirSync(TRAY_DIR, { recursive: true })

369 const tarPath = path.join(TRAY_DIR, `tray-${version}.tar.gz`)

370

371 // Descargar ANTES de borrar el viejo — si la descarga falla, el tray actual sigue intacto