Loading npm security reports…

local-mcp@3.0.377: AI-agent control-surface risk | LPM Firewall

registry / local-mcp / 3.0.377

local-mcp@3.0.377

Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm install automatically configures detected third-party AI clients to launch local-mcp. It downloads native executables and, on macOS, creates a persistent tray application LaunchAgent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Global npm installation runs postinstall.

Impact

AI clients can automatically launch a remotely supplied local server with access to the host capabilities advertised by the package.

Mechanism

Automatic foreign MCP configuration plus remote native payload installation and macOS persistence.

Policy narrative

Installing the package globally triggers setup without an explicit setup command. Setup detects installed AI clients and writes local-mcp launch entries into their MCP configuration. It also obtains a native server archive from package-controlled endpoints without cryptographic verification. On macOS, the package installs a tray application and writes a LaunchAgent configured to start it at login. This is an unconsented install-time mutation of foreign AI-agent control surfaces combined with a remotely supplied executable payload.

Rationale

The source implements a concrete unconsented global postinstall chain that changes third-party AI-client control surfaces and installs remote native code. Product-aligned endpoints do not remove that lifecycle risk.

Evidence

package.jsonpostinstall.jssetup.jsdownload.jsindex.js~/.local/share/local-mcp/bin~/Library/LaunchAgents/com.local-mcp.tray.plist

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L7: * local-mcp setup → configura todos los clientes detectados L8: * local-mcp setup --all → configura todos sin preguntar L9: */ ... L13: const os = require('os') L14: const { execSync, execFileSync } = require('child_process') L15: const download = require('./download') ... L69: ' # curl telemetry — no Node dependency, fire-and-forget', L70: ` curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`, L71: ' -H "Content-Type: application/json" \\', L72: ' -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &', L73: ' pr

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

download.jsView file

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar'

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.jsView on unpkg · L7

544Trigger-reachable chain: manifest.main -> index.js -> download.js L544: if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) { L545: try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ } L546: } ... L557: L558: const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz` L559: process.stderr.write(`\nDescargando tray v${version}...\n`) L560:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

download.jsView on unpkg · L544

12const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14:

High

Child Process

Package source references child process execution.

download.jsView on unpkg · L12

setup.jsView file

45// Write a .cmd wrapper that Claude Desktop can execute L46: fs.mkdirSync(cacheDir, { recursive: true }) L47: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') ... L52: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest\r\n` L53: fs.writeFileSync(cmdPath, script) L54: return cmdPath ... L59: try { L60: fs.mkdirSync(cacheDir, { recursive: true }) L61: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L77: ].join('\n') + '\n' L78: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L79: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L45

1026Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L1026: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L1027: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L1028: // launchctl unload kills the running process AND prevents it from restarting L1029: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L1030: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L1040: try { L1041: const https = require('https') L1042: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L1026

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.374 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.374 similarity = 1.000 summary = normalized source hash matched finalized malicious source

index.jsView file

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.374 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.374 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "local-mcp",

3 "version": "3.0.377",

4 "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. On your Mac, no API keys, free.",

5 "main": "index.js",

6 "bin": {

7 "local-mcp": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node --test test/*.test.js"

12 },

13 "files": [

14 "index.js",

15 "download.js",

16 "setup.js",

17 "postinstall.js",

18 "README.md"

19 ],

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

20 "engines": {

21 "node": ">=18"

22 },

23 "os": [

24 "darwin",

25 "linux",

26 "win32"

27 ],

28 "keywords": [

29 "mcp",

30 "model-context-protocol",

download.jsView file

Lines 1-76javascript

1'use strict'

2/**

3 * download.js — descarga y cachea el binario standalone de LMCP desde R2.

4 * El binario fue compilado con PyInstaller — no requiere Python instalado.

5 * Cache: ~/.local/share/local-mcp/bin/{version}/

6 */

7

8const https = require('https')

setup.jsView file

45// Write a .cmd wrapper that Claude Desktop can execute L46: fs.mkdirSync(cacheDir, { recursive: true }) L47: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') ... L52: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest\r\n` L53: fs.writeFileSync(cmdPath, script) L54: return cmdPath ... L59: try { L60: fs.mkdirSync(cacheDir, { recursive: true }) L61: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L77: ].join('\n') + '\n' L78: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L79: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L45

1026Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L1026: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L1027: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L1028: // launchctl unload kills the running process AND prevents it from restarting L1029: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L1030: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L1040: try { L1041: const https = require('https') L1042: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L1026

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.374 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.374 similarity = 1.000 summary = normalized source hash matched finalized malicious source

index.jsView file

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.374 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.374 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Lines 524-564javascript

524 // and only the durable one survives to stop a resurrection loop (FB-D1FA79).

525 const uninstalledMarkers = [

526 path.join(CACHE_DIR, '..', '.uninstalled'),

527 path.join(os.homedir(), 'Library', 'Application Support', 'Local MCP', '.uninstalled'),

528 ]

529 if (uninstalledMarkers.some((p) => { try { return fs.existsSync(p) } catch { return false } })) return null

530

531 const info = await getLatestBinary()

532 const version = info.version

533 const trayApp = TRAY_APP

534 const verFile = path.join(TRAY_DIR, '.version')

535

536 // Migrar instalación vieja de ~/.local/share si existe

537 const oldTrayApp = path.join(TRAY_DIR, 'LocalMCPTray.app')

538 if (fs.existsSync(oldTrayApp)) {

539 try { execFileSync('rm', ['-rf', oldTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

540 }

541

542 // Migrar instalación vieja de /Applications → ~/Applications (evita diálogo App Management)

543 const systemTrayApp = '/Applications/LocalMCPTray.app'

544 if (fs.existsSync(systemTrayApp) && trayApp !== systemTrayApp) {

545 try { execFileSync('rm', ['-rf', systemTrayApp], { stdio: 'pipe' }) } catch { /* ignorar */ }

546 }

547

548 // Ya instalado y actualizado

549 if (fs.existsSync(trayApp) && fs.existsSync(verFile)) {

550 if (fs.readFileSync(verFile, 'utf8').trim() === version) return trayApp

551 }

552

553 // In an active MCP session (non-TTY) the tray is running and self-updates via UpdateManager.

554 // Downloading a new tray bundle and rm-rf'ing the old one mid-session kills the Unix socket

555 // that local-mcp-server uses, crashing the session. Skip the update; it'll apply next login.

556 if (!process.stdin.isTTY && fs.existsSync(trayApp)) return trayApp

557

558 const url = `https://download.local-mcp.com/local-mcp-tray-${version}-darwin-universal.tar.gz`

559 process.stderr.write(`\nDescargando tray v${version}...\n`)

560

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

download.jsView on unpkg · L544

561 fs.mkdirSync(TRAY_DIR, { recursive: true })

562 const tarPath = path.join(TRAY_DIR, `tray-${version}.tar.gz`)

563

564 // Descargar ANTES de borrar el viejo — si la descarga falla, el tray actual sigue intacto