AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 3
579 packages with LPM's own review, newest scan first. Showing 97–144.
The global-install postinstall path automatically starts all-client setup, which invokes a runtime command to configure AI clients without an explicit consent step. This is unconsented in...
The package automatically invokes a script that edits another installed product’s runtime hook code to expose session messages. This meets the blocking criterion for unconsented postinsta...
The source confirms an automatic install hook that writes package-owned AI workflow content into the consumer’s agent configuration area and prunes stale files there. This is an unconsent...