Hostile 93% javascript Download

local-mcp 3.0.417

Exfiltrates credentials, persists, manipulates TCC

“Let ChatGPT, Claude, Cursor & any MCP client actually use your Mac or Windows PC — read & reply to email, manage your calendar, text over i…”

Declares an npm postinstall lifecycle hookExecutes shell commands synchronously
SHA-2561cbe06b1f75b9be362e40c1adcb338af5dfd8c23dfa98b155ea8df546fd1cd4f
URLhttps://registry.npmjs.org/local-mcp/-/local-mcp-3.0.417.tgz
MaleculeK₂(AmLi₂)O₆(As₂C₃ErP₈S₇Xe₂)H₇(Cm₃₃CrDb₁₃F₂₀Os₁₈Po₂₁U)Md₄(In₇Pa₆Pt₂)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.