AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 7
579 packages with LPM's own review, newest scan first. Showing 289–336.
This is an unconsented postinstall mutation of broad foreign AI-agent control surfaces. Checksum verification reduces tampering risk for the downloaded binary but does not establish conse...
This is an unconsented postinstall mutation of a broad global AI-agent control surface. Exclusive creation avoids overwrites but does not remove the risk of first-install persistence.
The package has a concrete automatic postinstall chain that modifies multiple AI-agent homes and installs hooks, rather than requiring an explicit setup command. This meets the install-co...