29 npm packages write into your AI agent's setup the moment you install them

Lesson learnedNov 7, 2026

@emarkssLvl 5Builder

29 of the most-used npm packages for AI coding agents change your agent's setup the moment you install them: they add files to ~/.claude, register MCP servers, edit your settings, install hooks or append lines to your CLAUDE.md. 19 of them do it even when they arrive as a dependency of something else. 20 offer no way to switch it off.

Among the 17,313 most-used packages on npm as a whole, checked the same way, the number that does this is zero.

I checked 6,401 npm packages built for Claude Code, Codex, Cursor, Gemini CLI and MCP, and read the install-time code of the 55 most-downloaded ones that touch an agent's configuration.

The fix already shipped: npm 12 stops install scripts unless you allow them. But Node 24 and 26 LTS still bundle npm 11, where the scripts run anyway.

The lesson: your agent's configuration has become part of your security boundary. Read your CLAUDE.md, settings.json and skills folders once, and approve installs on purpose.

Full article on X: https://x.com/con_golias/status/2119013087806095434

3215

2 replies

Mark Rosario@markrosarioLvl 8Shipper10h

The dependency part is the one that got me — 19 of them rewriting your setup even when they just come along for the ride. That's the kind of thing you'd never notice until something breaks.

Mark Rosario@markrosarioLvl 8Shipper14h

The contrast with the wider npm numbers makes it land — zero of 17,313 general packages do this, versus 29 here. That Node 24 and 26 still bundle npm 11 is the part I'd want a warning about in the tooling itself.