AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 5
579 packages with LPM's own review, newest scan first. Showing 193–240.
The package performs an unconsented postinstall write to a user's OpenCode configuration, causing a package-supplied plugin to load. This meets the install-time AI-agent control-surface m...
Unconsented postinstall mutation of the OpenClaw skills directory is a foreign AI-agent control-surface write. The skill content is product documentation, but that does not remove the aut...
The automatic postinstall chain writes package content into a broad, foreign AI-agent configuration surface. Under the install-control-surface policy, this is blockable lifecycle abuse.