local-mcp@3.0.370: AI-agent control-surface risk

Loading npm security reports…

Source & flagged code

14 flagged

Lines 1-30json

2 "name": "local-mcp",

3 "version": "3.0.370",

4 "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.",

5 "main": "index.js",

6 "bin": {

7 "local-mcp": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "index.js",

14 "download.js",

15 "setup.js",

16 "postinstall.js",

17 "README.md"

18 ],

19 "engines": {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

20 "node": ">=18"

21 },

22 "os": [

23 "darwin"

24 ],

25 "keywords": [

26 "mcp",

27 "model-context-protocol",

28 "mcp-server",

29 "claude",

30 "claude-desktop",

download.jsView file

Lines 1-32javascript

1'use strict'

2/**

3 * download.js — descarga y cachea el binario standalone de LMCP desde R2.

4 * El binario fue compilado con PyInstaller — no requiere Python instalado.

5 * Cache: ~/.local/share/local-mcp/bin/{version}/

6 */

8const https = require('https')

setup.jsView file

40// Write a .cmd wrapper that Claude Desktop can execute L41: fs.mkdirSync(cacheDir, { recursive: true }) L42: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') L43: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest %*\r\n` L44: fs.writeFileSync(cmdPath, script) L45: return cmdPath ... L50: try { L51: fs.mkdirSync(cacheDir, { recursive: true }) L52: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L68: ].join('\n') + '\n' L69: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L70: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

888Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L888: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L889: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L890: // launchctl unload kills the running process AND prevents it from restarting L891: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L892: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L902: try { L903: const https = require('https') L904: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L888

index.jsView file

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.362 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.362 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L7: * local-mcp setup → configura todos los clientes detectados L8: * local-mcp setup --all → configura todos sin preguntar L9: */ ... L13: const os = require('os') L14: const { execSync, execFileSync } = require('child_process') L15: ... L60: ' # curl telemetry — no Node dependency, fire-and-forget', L61: ` curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`, L62: ' -H "Content-Type: application/json" \\', L63: ' -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &', L64: ' printf \'LMCP requires Node 16+. Current

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

•scripts.postinstall = node postinstall.js

Medium

local-mcp@3.0.370: AI-agent control-surface risk | LPM Firewall

Source & flagged code

14 flagged

package.jsonView file

Lines 1-30json

2 "name": "local-mcp",

3 "version": "3.0.370",

5 "main": "index.js",

6 "bin": {

7 "local-mcp": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 },

12 "files": [

13 "index.js",

14 "download.js",

15 "setup.js",

16 "postinstall.js",

17 "README.md"

18 ],

19 "engines": {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

20 "node": ">=18"

21 },

22 "os": [

23 "darwin"

24 ],

25 "keywords": [

26 "mcp",

27 "model-context-protocol",

28 "mcp-server",

29 "claude",

30 "claude-desktop",

download.jsView file

Lines 1-32javascript

1'use strict'

2/**

3 * download.js — descarga y cachea el binario standalone de LMCP desde R2.

4 * El binario fue compilado con PyInstaller — no requiere Python instalado.

5 * Cache: ~/.local/share/local-mcp/bin/{version}/

6 */

8const https = require('https')

setup.jsView file

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L40

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L888

index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Lines 371-411javascript

371 // and only the durable one survives to stop a resurrection loop (FB-D1FA79).

372 const uninstalledMarkers = [

373 path.join(CACHE_DIR, '..', '.uninstalled'),

374 path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled'),

375 ]

376 if (uninstalledMarkers.some((p) => { try { return fs.existsSync(p) } catch { return false } })) return null

377

378 const info = await getLatestBinary()

379 const version = info.version

380 const trayApp = TRAY_APP

381 const verFile = path.join(TRAY_DIR, '.version')

382

383 // Migrar instalación vieja de ~/.local/share si existe

384 const oldTrayApp = path.join(TRAY_DIR, 'LocalMCPTray.app')

385 if (fs.existsSync(oldTrayApp)) {

386 try { execFileSync('rm', ['-rf', oldTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

387 }

388

389 // Migrar instalación vieja de /Applications → ~/Applications (evita diálogo App Management)

390 const systemTrayApp = '/Applications/LocalMCPTray.app'

391 if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) {

392 try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

393 }

394

395 // Ya instalado y actualizado

396 if (fs.existsSync(trayApp) && fs.existsSync(verFile)) {

397 if (fs.readFileSync(verFile, 'utf8').trim() === version) return trayApp

398 }

399

400 // In an active MCP session (non-TTY) the tray is running and self-updates via UpdateManager.

401 // Downloading a new tray bundle and rm-rf'ing the old one mid-session kills the Unix socket

402 // that local-mcp-server uses, crashing the session. Skip the update; it'll apply next login.

403 if (!process.stdin.isTTY && fs.existsSync(trayApp)) return trayApp

404

405 const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz`

406 process.stderr.write(`\nDescargando tray v${version}...\n`)

407

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

download.jsView on unpkg · L391

408 fs.mkdirSync(TRAY_DIR, { recursive: true })

409 const tarPath = path.join(TRAY_DIR, `tray-${version}.tar.gz`)

410

411 // Descargar ANTES de borrar el viejo — si la descarga falla, el tray actual sigue intacto

local-mcp@3.0.370

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code