AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 10
579 packages with LPM's own review, newest scan first. Showing 433–480.
The lifecycle hook performs persistent global Claude Code command installation, which meets the firewall block boundary for unconsented postinstall mutation of a foreign/broad AI-agent co...
The package performs unconsented postinstall mutation of a foreign AI-agent configuration and enables external agent control channels. This meets the firewall blocking boundary even thoug...
The package’s stated feature is implemented through an automatic postinstall mutation of several third-party/shared AI-agent skill locations. That concrete lifecycle control-surface write...