AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 11
579 packages with LPM's own review, newest scan first. Showing 481–528.
源码确认了安装时对多个非本包拥有的 AI 工具用户配置的持久化修改，满足阻断条件。运行时还存在向默认远程 MCP 服务转发本地认证配置的具体链路。
The lifecycle path concretely modifies broad Codex control surfaces and project hooks/configuration during installation. This meets the blocking policy even though no data-exfiltration ch...
Source inspection confirms a concrete, unconsented postinstall mutation of broad AI-agent control files, sourced from a remote mutable archive. This meets the blocking policy.