AI-agent control-surface risk in npm packages.
These packages silently write AI-agent control files during install: agent instructions, MCP server entries, hooks or permission settings for tools such as Claude, Codex or Cursor. This is a dangerous-capability policy finding, not necessarily malware. LPM CLI warns by default and blocks when Firewall is configured to.
Packages — page 9
579 packages with LPM's own review, newest scan first. Showing 385–432.
The package's global postinstall mutates several foreign AI-agent skill directories automatically. That concrete lifecycle behavior meets the firewall block boundary even though its searc...
The package performs unconsented postinstall mutation of broad, foreign AI-agent skill directories. This meets the firewall block rule even though no credential theft was found.
The automatic postinstall mutation of broad, foreign AI-agent skill directories is a concrete unconsented control-surface change. No credential theft was found, but the lifecycle behavior...