AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 4
579 packages with LPM's own review, newest scan first. Showing 145–192.
The source proves automatic install-time mutation of global Claude Code command settings with consent prompts bypassed. This meets the supplied blocking policy for a foreign AI-agent cont...
The inspected lifecycle chain performs unconsented postinstall mutation across foreign AI-agent control surfaces, which meets the supplied blocking policy. Transactional writes and packag...
Inspected source proves an automatic, unconsented postinstall write to Pi's global agent control surface. Under the supplied policy, this warrants blocking despite guards that preserve ex...