AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 12
579 packages with LPM's own review, newest scan first. Showing 529–576.
The package performs concrete install-time writes to the user's Claude skill directory and executes follow-on tooling. That meets the firewall block boundary for unconsented postinstall m...
Source inspection confirms concrete install-time writes into Claude Code control files, including persistent hooks that affect later agent behavior. Under the provided policy, unconsented...
Source inspection confirms unconsented postinstall mutation of broad/foreign AI-agent control surfaces, which meets the block policy even though the shipped skill content is mostly packag...