AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 6
579 packages with LPM's own review, newest scan first. Showing 241–288.
The automatic lifecycle chain performs unconsented global AI-agent MCP registration. This is concrete install-hook abuse even though no secret theft or network exfiltration was found in t...
The package performs unconsented postinstall mutation of consumer AI-agent configuration, including an enabled remote MCP channel and broad permissions. This meets the install-control-sur...
The automatic postinstall hook rewrites a foreign AI runtime in the consumer dependency tree. This is a concrete install-hook abuse even though the inspected code does not exfiltrate data.