Loading npm security reports…

local-mcp@3.0.413: AI-agent control-surface risk | LPM Firewall

registry / local-mcp / 3.0.413

local-mcp@3.0.413

Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac or Windows PC — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. Runs locally, no API keys, free.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically downloads a remote runtime and invokes it to configure installed AI/MCP clients. This mutates a broad AI-agent control surface during postinstall without a separate user command.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Global npm installation runs the declared postinstall hook.

Impact

A remotely supplied executable can alter MCP client launch configuration, causing AI clients to launch this package's server.

Mechanism

postinstall.js calls runSetup with all clients enabled; setup downloads or locates the runtime and launches it with --configure-clients, delegating configuration writes to that binary.

Policy narrative

Installing this package globally triggers postinstall automatically. The hook runs setup for all clients, downloads a remotely selected runtime, and executes that runtime to write AI/MCP client configuration. This creates an unconsented lifecycle path from npm installation to broad agent-control configuration changes.

AI rationale

The automatic global postinstall chain delegates broad AI-client configuration writes to a remotely downloaded binary. This is concrete install-time AI-agent control-surface mutation and meets the blocking policy.

Evidence

package.jsonpostinstall.jssetup.jsdownload.js

Network endpoints2

office-mcp-production.up.railway.app

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L7: * local-mcp setup → configura todos los clientes detectados L8: * local-mcp setup --all → configura todos sin preguntar L9: */ ... L13: const os = require('os') L14: const { execSync, execFileSync } = require('child_process') L15: const download = require('./download') ... L69: ' # curl telemetry — no Node dependency, fire-and-forget', L70: ` curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`, L71: ' -H "Content-Type: application/json" \\', L72: ' -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &', L73: ' pr

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

download.jsView file

•Trigger-reachable chain: manifest.main -> index.js -> download.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

download.jsView on unpkg

12const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14:

High

Child Process

Package source references child process execution.

download.jsView on unpkg · L12

60// Only the win32 ladder reads/writes it: it's the side of the probe that can L61: // come up empty on a real machine (wmic gone, PowerShell blocked by policy), L62: // and consulting the same file the go-server already wrote/reads is what lets

High

Shell

Package source references shell execution.

download.jsView on unpkg · L60

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L17: function extractTar(tarPath, destDir) { L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar' ... L39: const CACHE_DIR = process.platform === 'win32' L40: ? path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'local-mcp', 'bin')

download.js#virtual:normalized:round1View file

7L8: const https = require("https") L9: const http = require("http") ... L12: const os = require("os") L13: const { execFileSync, execSync } = require("child_process") L14: L15: // On Windows, Git-Bash"s tar interprets \"C:...\" paths as \"host:path\" (SSH syntax).\n// Use the native Windows tar.exe from System32 instead, which handles Win32 paths correctl... L16: // the caller would otherwise mask as "not yet available" (#1256).

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.js#virtual:normalized:round1View on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

download.js#virtual:normalized:round1View on unpkg

setup.jsView file

45// Write a .cmd wrapper that Claude Desktop can execute L46: fs.mkdirSync(cacheDir, { recursive: true }) L47: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') ... L52: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest\r\n` L53: fs.writeFileSync(cmdPath, script) L54: return cmdPath ... L59: try { L60: fs.mkdirSync(cacheDir, { recursive: true }) L61: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L77: ].join('\n') + '\n' L78: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L79: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L45

928if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L929: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L930: // launchctl unload kills the running process AND prevents it from restarting L931: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L932: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L942: try { L943: const https = require('https') L944: const payload = {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

setup.jsView on unpkg · L928

928Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L928: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L929: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L930: // launchctl unload kills the running process AND prevents it from restarting L931: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L932: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L942: try { L943: const https = require('https') L944: const payload = {

Lines 40-80javascript

40 ? path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'local-mcp', 'bin')

41 : path.join(os.homedir(), '.local', 'share', 'local-mcp', 'bin')

42

43const TRAY_DIR = process.platform === 'win32'

44 ? path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'local-mcp', 'tray')

45 : path.join(os.homedir(), '.local', 'share', 'local-mcp', 'tray')

46

47// Install to ~/Applications (user-owned) to avoid macOS App Management TCC prompt.

48// /Applications requires kTCCServiceAppManagement permission which shows "node would like

49// to access data from other apps" on every tray update — confusing and unnecessary.

50// On Windows/Linux there is no tray app yet.

51const TRAY_APP = process.platform === 'darwin'

52 ? path.join(os.homedir(), 'Applications', 'LocalMCPTray.app')

53 : null

54

55// La instalación vieja que TRAY_APP supersede. Const (no literal suelto) porque el orden en

56// que se la retira es lo que arregla #2654 y los tests la inyectan.

57const SYSTEM_TRAY_APP = '/Applications/LocalMCPTray.app'

58

59// Mirror of go-server's CacheDir()/.machine-id (internal/machineid/machineid.go).

60// Only the win32 ladder reads/writes it: it's the side of the probe that can

61// come up empty on a real machine (wmic gone, PowerShell blocked by policy),

62// and consulting the same file the go-server already wrote/reads is what lets

High

Shell

Package source references shell execution.

download.jsView on unpkg · L60

63// the two sides converge on one id instead of the hostname-hash fallback.

64// cacheDir is a parameter (not read from the module-level CACHE_DIR directly)

65// for the same reason setup.js's _cloudTokenPath/_readCachedCloudToken/

66// _writeCloudToken take it explicitly: it lets tests point at a temp dir

67// instead of writing into the real user's cache.

68const WIN_MACHINE_ID_CACHE_NAME = '.machine-id'

69

70function _readWinMachineIdCache(cacheDir) {

71 try {

72 return fs.readFileSync(path.join(cacheDir, WIN_MACHINE_ID_CACHE_NAME), 'utf8').trim()

73 } catch {

74 return ''

75 }

76}

77

78function _writeWinMachineIdCache(cacheDir, id) {

79 try {

80 fs.mkdirSync(cacheDir, { recursive: true })