Loading npm security reports…

local-mcp@3.0.368: AI-agent control-surface risk | LPM Firewall

registry / local-mcp / 3.0.368

local-mcp@3.0.368

Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically modifies detected third-party AI-client MCP configuration files, causing them to launch this package through npx. The installed runtime then downloads and executes remotely supplied native payloads.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm install -g local-mcp on macOS

Impact

Unconsented persistent execution through multiple AI clients; backend-controlled binaries can execute with the user's permissions.

Mechanism

postinstall AI-agent config takeover plus unsigned remote native payload delivery

Policy narrative

On global macOS installation, the postinstall hook invokes setup with all clients enabled. It detects installed AI applications and inserts a local-mcp command into their MCP configurations, while deleting office-mcp in several formats. Setup downloads runtime/tray payloads; download.js obtains version and, for some platforms, artifact URLs from the backend, follows redirects, extracts them, and index.js executes the resulting native binary. This creates an unconsented cross-client AI-agent execution path with backend-controlled code.

Rationale

This meets the blocking policy: an npm postinstall mutates broad foreign AI-agent control surfaces without an explicit user setup command. The remote executable delivery chain materially increases the impact.

Evidence

package.jsonpostinstall.jssetup.jsdownload.jsindex.js~/Library/Application Support/Claude/claude_desktop_config.json

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L7: * local-mcp setup → configura todos los clientes detectados L8: * local-mcp setup --all → configura todos sin preguntar L9: */ ... L13: const os = require('os') L14: const { execSync, execFileSync } = require('child_process') L15: ... L60: ' # curl telemetry — no Node dependency, fire-and-forget', L61: ` curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`, L62: ' -H "Content-Type: application/json" \\', L63: ' -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &', L64: ' printf \'LMCP requires Node 16+. Current

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

download.jsView file

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar'

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.jsView on unpkg · L7

•matchType = previous_version_dangerous_delta matchedPackage = local-mcp@3.0.331 matchedIdentity = npm:bG9jYWwtbWNw:3.0.331 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

download.jsView on unpkg

12const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14:

High

Child Process

Package source references child process execution.

download.jsView on unpkg · L12

351if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) { L352: try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ } L353: } ... L364: L365: const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz` L366: process.stderr.write(`\nDescargando tray v${version}...\n`) L367:

setup.jsView file

40// Write a .cmd wrapper that Claude Desktop can execute L41: fs.mkdirSync(cacheDir, { recursive: true }) L42: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') L43: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest %*\r\n` L44: fs.writeFileSync(cmdPath, script) L45: return cmdPath ... L50: try { L51: fs.mkdirSync(cacheDir, { recursive: true }) L52: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L68: ].join('\n') + '\n' L69: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L70: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.367 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.367 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.jsView on unpkg

index.jsView file

14Trigger-reachable persistence chain: manifest.main -> index.js L14: L15: const { spawn, execFileSync, execSync } = require('child_process') L16: const path = require('path') ... L18: const fs = require('fs') L19: const https = require('https') L20: ... L35: const list = [path.join(path.dirname(CACHE_DIR), '.uninstalled')] L36: if (process.platform === 'darwin') { L37: list.push(path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled')) L38: } ... L68: 'Then restart Claude Desktop / Cursor.' L69: process.stderr.write(msg + '\n')

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

index.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.367 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.367 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "local-mcp",

3 "version": "3.0.368",

4 "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.",

5 "main": "index.js",

6 "bin": {

7 "local-mcp": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "index.js",

14 "download.js",

15 "setup.js",

16 "postinstall.js",

17 "README.md"

18 ],

19 "engines": {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

20 "node": ">=18"

21 },

22 "os": [

23 "darwin"

24 ],

25 "keywords": [

26 "mcp",

27 "model-context-protocol",

28 "mcp-server",

29 "claude",

30 "claude-desktop",

download.jsView file

Lines 1-32javascript

1'use strict'

2/**

3 * download.js — descarga y cachea el binario standalone de LMCP desde R2.

4 * El binario fue compilado con PyInstaller — no requiere Python instalado.

5 * Cache: ~/.local/share/local-mcp/bin/{version}/

6 */

7

8const https = require('https')

setup.jsView file

40// Write a .cmd wrapper that Claude Desktop can execute L41: fs.mkdirSync(cacheDir, { recursive: true }) L42: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') L43: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest %*\r\n` L44: fs.writeFileSync(cmdPath, script) L45: return cmdPath ... L50: try { L51: fs.mkdirSync(cacheDir, { recursive: true }) L52: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L68: ].join('\n') + '\n' L69: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L70: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.367 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.367 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

setup.jsView on unpkg

index.jsView file

14Trigger-reachable persistence chain: manifest.main -> index.js L14: L15: const { spawn, execFileSync, execSync } = require('child_process') L16: const path = require('path') ... L18: const fs = require('fs') L19: const https = require('https') L20: ... L35: const list = [path.join(path.dirname(CACHE_DIR), '.uninstalled')] L36: if (process.platform === 'darwin') { L37: list.push(path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled')) L38: } ... L68: 'Then restart Claude Desktop / Cursor.' L69: process.stderr.write(msg + '\n')

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

index.jsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.367 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.367 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Lines 331-371javascript

331 // and only the durable one survives to stop a resurrection loop (FB-D1FA79).

332 const uninstalledMarkers = [

333 path.join(CACHE_DIR, '..', '.uninstalled'),

334 path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled'),

335 ]

336 if (uninstalledMarkers.some((p) => { try { return fs.existsSync(p) } catch { return false } })) return null

337

338 const info = await getLatestBinary()

339 const version = info.version

340 const trayApp = TRAY_APP

341 const verFile = path.join(TRAY_DIR, '.version')

342

343 // Migrar instalación vieja de ~/.local/share si existe

344 const oldTrayApp = path.join(TRAY_DIR, 'LocalMCPTray.app')

345 if (fs.existsSync(oldTrayApp)) {

346 try { execFileSync('rm', ['-rf', oldTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

347 }

348

349 // Migrar instalación vieja de /Applications → ~/Applications (evita diálogo App Management)

350 const systemTrayApp = '/Applications/LocalMCPTray.app'

351 if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) {

352 try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

353 }

354

355 // Ya instalado y actualizado

356 if (fs.existsSync(trayApp) && fs.existsSync(verFile)) {

357 if (fs.readFileSync(verFile, 'utf8').trim() === version) return trayApp

358 }

359

360 // In an active MCP session (non-TTY) the tray is running and self-updates via UpdateManager.

361 // Downloading a new tray bundle and rm-rf'ing the old one mid-session kills the Unix socket

362 // that local-mcp-server uses, crashing the session. Skip the update; it'll apply next login.

363 if (!process.stdin.isTTY && fs.existsSync(trayApp)) return trayApp

364

365 const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz`

366 process.stderr.write(`\nDescargando tray v${version}...\n`)

367

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

download.jsView on unpkg · L351

368 fs.mkdirSync(TRAY_DIR, { recursive: true })

369 const tarPath = path.join(TRAY_DIR, `tray-${version}.tar.gz`)

370

371 // Descargar ANTES de borrar el viejo — si la descarga falla, el tray actual sigue intacto