AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 2
579 packages with LPM's own review, newest scan first. Showing 49–96.
Source confirms that postinstall automatically modifies the consumer's project-level Claude configuration and imports package-authored guidance without affirmative consent. This meets the...
Source confirms an automatic install hook that adds the package’s MCP server to multiple agent configuration surfaces without consent. This is an unconsented install-time AI-agent control...
The manifest activates a postinstall hook that targets the consumer project and automatically generates framework content for multiple agent CLIs. This is unconsented lifecycle mutation o...