AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 8
579 packages with LPM's own review, newest scan first. Showing 337–384.
The package performs an unconsented postinstall write to a broad AI-agent control surface in the consumer project. Although no exfiltration or network activity was found, this concrete li...
The automatic lifecycle hook mutates a global AI-agent skill directory and can recursively delete a pre-existing matching entry. The weak installation guard makes this occur beyond an exp...
The automatic lifecycle hook force-installs a package-controlled skill into user-wide directories for two agent ecosystems. That meets the install-control-surface block policy regardless...