Loading npm security reports…

local-mcp@3.0.414: AI-agent control-surface risk | LPM Firewall

registry / local-mcp / 3.0.414

local-mcp@3.0.414

Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac or Windows PC — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. Runs locally, no API keys, free.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. A global npm installation automatically configures detected third-party AI clients through a downloaded runtime. It also downloads a tray application and creates a login LaunchAgent.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Installing the package globally runs its postinstall hook.

Impact

This mutates broad AI-agent control surfaces and establishes persistent execution without a separate setup command or consent prompt.

Mechanism

The hook calls all-client setup, creates a launcher that fetches the latest package release, invokes a runtime client configurator, downloads a tray application, and persists it with a LaunchAgent.

Policy narrative

On global installation, the declared postinstall hook automatically calls setup for all clients. Setup creates an AI-client launcher that invokes the latest local-mcp release and directs a downloaded runtime to configure detected clients. The setup path also downloads a tray application and writes a macOS LaunchAgent configured to run at login. This is an unconsented install-time mutation of third-party AI-client configuration plus persistence.

AI rationale

The automatic global-install path changes broad AI-agent configuration and adds login persistence. Its self-updating launcher compounds the unconsented lifecycle chain.

Evidence

package.jsonpostinstall.jssetup.jsdownload.js~/Library/LaunchAgents/com.local-mcp.tray.plist

Network endpoints1

Source & flagged code

17 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

7scripts.postinstall = node postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L7: * local-mcp setup → configura todos los clientes detectados L8: * local-mcp setup --all → configura todos sin preguntar L9: */ ... L13: const os = require('os') L14: const { execSync, execFileSync } = require('child_process') L15: const download = require('./download') ... L69: ' # curl telemetry — no Node dependency, fire-and-forget', L70: ` curl -sf --max-time 3 -X POST "https://${BACKEND_HOST}/install-event" \\`, L71: ' -H "Content-Type: application/json" \\', L72: ' -d "{\\\"stage\\\":\\\"node_too_old\\\",\\\"version\\\":\\\"$NODE_VER\\\"}" &>/dev/null &', L73: ' pr

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

download.jsView file

12const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14:

High

Child Process

Package source references child process execution.

download.jsView on unpkg · L12

60// Only the win32 ladder reads/writes it: it's the side of the probe that can L61: // come up empty on a real machine (wmic gone, PowerShell blocked by policy), L62: // and consulting the same file the go-server already wrote/reads is what lets

High

Shell

Package source references shell execution.

download.jsView on unpkg · L60

7L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L17: function extractTar(tarPath, destDir) { L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar' ... L39: const CACHE_DIR = process.platform === 'win32' L40: ? path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'local-mcp', 'bin')

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

download.jsView on unpkg · L7

7Trigger-reachable persistence chain: manifest.main -> index.js -> download.js L7: L8: const https = require('https') L9: const http = require('http') ... L12: const os = require('os') L13: const { execFileSync, execSync } = require('child_process') L14: ... L17: function extractTar(tarPath, destDir) { L18: const tarBin = process.platform === 'win32' L19: ? path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') L20: : 'tar' ... L39: const CACHE_DIR = process.platform === 'win32' L40: ? path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'local-mcp', 'bin')

download.js#virtual:normalized:round1View file

7L8: const https = require("https") L9: const http = require("http") ... L12: const os = require("os") L13: const { execFileSync, execSync } = require("child_process") L14: L15: // On Windows, Git-Bash"s tar interprets \"C:...\" paths as \"host:path\" (SSH syntax).\n// Use the native Windows tar.exe from System32 instead, which handles Win32 paths correctl... L16: // the caller would otherwise mask as "not yet available" (#1256).

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.js#virtual:normalized:round1View on unpkg · L7

76Trigger-reachable chain: manifest.main -> index.js -> download.js L76: // each of those would pay a fresh PowerShell spawn. A failed probe is L77: // memoized too, on purpose: a run where PowerShell is blocked shouldn"t retry\n// it on every subsequent call in the same process.\nlet _winHardwareIdCache\n// execImpl is injecta... L78: // Get() — so a smoke-* run stays a smoke-* run on every code path that ... L91: const ioreg = execSync("ioreg -rd1 -c IOPlatformExpertDevice", { stdio: "pipe" }).toString() L92: const match = ioreg.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)\n if (match) return match[1]\n } catch {}\n } else if (platform === 'win32') {\n const hw = _probeWinHardw... L93: // to delete" (same rule as index.js's countRunningServers, #1394 §C).\nfunction _isTrayRunningF

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

download.js#virtual:normalized:round1View on unpkg · L76

setup.jsView file

45// Write a .cmd wrapper that Claude Desktop can execute L46: fs.mkdirSync(cacheDir, { recursive: true }) L47: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') ... L52: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest\r\n` L53: fs.writeFileSync(cmdPath, script) L54: return cmdPath ... L59: try { L60: fs.mkdirSync(cacheDir, { recursive: true }) L61: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L77: ].join('\n') + '\n' L78: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L79: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L45

928Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L928: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L929: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L930: // launchctl unload kills the running process AND prevents it from restarting L931: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L932: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L942: try { L943: const https = require('https') L944: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L928

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.413 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.413 similarity = 1.000 summary = normalized source hash matched finalized malicious source

index.jsView file

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.413 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.413 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Source & flagged code

17 flagged

package.jsonView file

Lines 1-30json

1{

2 "name": "local-mcp",

3 "version": "3.0.414",

4 "description": "Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac or Windows PC — read & reply to email, manage your calendar, text over iMessage, find files, work with Teams, Slack & Office. Runs locally, no API keys, free.",

5 "main": "index.js",

6 "bin": {

7 "local-mcp": "index.js"

8 },

9 "scripts": {

10 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L10

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L10

11 "test": "node --test test/*.test.js"

12 },

13 "files": [

14 "index.js",

15 "download.js",

16 "setup.js",

17 "postinstall.js",

18 "README.md"

19 ],

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L7

20 "engines": {

21 "node": ">=18"

22 },

23 "os": [

24 "darwin",

25 "linux",

26 "win32"

27 ],

28 "keywords": [

29 "mcp",

30 "model-context-protocol",

download.jsView file

Lines 1-32javascript

1'use strict'

2/**

3 * download.js — descarga y cachea el binario standalone de LMCP desde R2.

4 * El binario fue compilado con PyInstaller — no requiere Python instalado.

5 * Cache: ~/.local/share/local-mcp/bin/{version}/

6 */

7

8const https = require('https')

download.js#virtual:normalized:round1View file

7L8: const https = require("https") L9: const http = require("http") ... L12: const os = require("os") L13: const { execFileSync, execSync } = require("child_process") L14: L15: // On Windows, Git-Bash"s tar interprets \"C:...\" paths as \"host:path\" (SSH syntax).\n// Use the native Windows tar.exe from System32 instead, which handles Win32 paths correctl... L16: // the caller would otherwise mask as "not yet available" (#1256).

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

download.js#virtual:normalized:round1View on unpkg · L7

76Trigger-reachable chain: manifest.main -> index.js -> download.js L76: // each of those would pay a fresh PowerShell spawn. A failed probe is L77: // memoized too, on purpose: a run where PowerShell is blocked shouldn"t retry\n// it on every subsequent call in the same process.\nlet _winHardwareIdCache\n// execImpl is injecta... L78: // Get() — so a smoke-* run stays a smoke-* run on every code path that ... L91: const ioreg = execSync("ioreg -rd1 -c IOPlatformExpertDevice", { stdio: "pipe" }).toString() L92: const match = ioreg.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)\n if (match) return match[1]\n } catch {}\n } else if (platform === 'win32') {\n const hw = _probeWinHardw... L93: // to delete" (same rule as index.js's countRunningServers, #1394 §C).\nfunction _isTrayRunningF

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

download.js#virtual:normalized:round1View on unpkg · L76

setup.jsView file

45// Write a .cmd wrapper that Claude Desktop can execute L46: fs.mkdirSync(cacheDir, { recursive: true }) L47: const cmdPath = path.join(cacheDir, 'lmcp-launch.cmd') ... L52: const script = `@echo off\r\n"${npxAbsPath}" -y local-mcp@latest\r\n` L53: fs.writeFileSync(cmdPath, script) L54: return cmdPath ... L59: try { L60: fs.mkdirSync(cacheDir, { recursive: true }) L61: const launcherPath = path.join(cacheDir, 'lmcp-launch.sh') ... L77: ].join('\n') + '\n' L78: fs.writeFileSync(launcherPath, script, { mode: 0o755 }) L79: return launcherPath

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

setup.jsView on unpkg · L45

928Trigger-reachable command-output exfiltration chain: scripts.postinstall -> postinstall.js -> setup.js L928: if (!content.includes('local-mcp-server') && !content.includes('Local MCP')) return L929: process.stderr.write('\n Migrating legacy server LaunchAgent to tray supervision...\n') L930: // launchctl unload kills the running process AND prevents it from restarting L931: try { execFileSync('launchctl', ['unload', plistPath], { stdio: 'pipe' }) } catch { /* may already be unloaded */ } L932: try { fs.unlinkSync(plistPath) } catch { /* non-fatal */ } ... L942: try { L943: const https = require('https') L944: const payload = {

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

setup.jsView on unpkg · L928

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.413 matchedPath = setup.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.413 similarity = 1.000 summary = normalized source hash matched finalized malicious source

index.jsView file

•matchType = normalized_sha256 matchedPackage = local-mcp@3.0.413 matchedPath = index.js matchedIdentity = npm:bG9jYWwtbWNw:3.0.413 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

Lines 40-80javascript

40 ? path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'local-mcp', 'bin')

41 : path.join(os.homedir(), '.local', 'share', 'local-mcp', 'bin')

42

43const TRAY_DIR = process.platform === 'win32'

44 ? path.join(process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local'), 'local-mcp', 'tray')

45 : path.join(os.homedir(), '.local', 'share', 'local-mcp', 'tray')

46

47// Install to ~/Applications (user-owned) to avoid macOS App Management TCC prompt.

48// /Applications requires kTCCServiceAppManagement permission which shows "node would like

49// to access data from other apps" on every tray update — confusing and unnecessary.

50// On Windows/Linux there is no tray app yet.

51const TRAY_APP = process.platform === 'darwin'

52 ? path.join(os.homedir(), 'Applications', 'LocalMCPTray.app')

53 : null

54

55// La instalación vieja que TRAY_APP supersede. Const (no literal suelto) porque el orden en

56// que se la retira es lo que arregla #2654 y los tests la inyectan.

57const SYSTEM_TRAY_APP = '/Applications/LocalMCPTray.app'

58

59// Mirror of go-server's CacheDir()/.machine-id (internal/machineid/machineid.go).

60// Only the win32 ladder reads/writes it: it's the side of the probe that can

61// come up empty on a real machine (wmic gone, PowerShell blocked by policy),

62// and consulting the same file the go-server already wrote/reads is what lets

High

Shell

Package source references shell execution.

download.jsView on unpkg · L60

63// the two sides converge on one id instead of the hostname-hash fallback.

64// cacheDir is a parameter (not read from the module-level CACHE_DIR directly)

65// for the same reason setup.js's _cloudTokenPath/_readCachedCloudToken/

66// _writeCloudToken take it explicitly: it lets tests point at a temp dir

67// instead of writing into the real user's cache.

68const WIN_MACHINE_ID_CACHE_NAME = '.machine-id'

69

70function _readWinMachineIdCache(cacheDir) {

71 try {

72 return fs.readFileSync(path.join(cacheDir, WIN_MACHINE_ID_CACHE_NAME), 'utf8').trim()

73 } catch {

74 return ''

75 }

76}

77

78function _writeWinMachineIdCache(cacheDir, id) {

79 try {

80 fs.mkdirSync(cacheDir, { recursive: true })