registry / @caeliq/llms / 1.0.56
@caeliq/llms@1.0.56
A universal LLM API transformation server
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe scanner's cloud-metadata and child-process signals are bundled google-auth-library behavior, not first-party malicious flow. Runtime creation of first-party Cursor hooks is a guarded extension lifecycle risk, warranting a warning rather than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Runtime request through the configured cursor-sdk transformer
Impact
Modifies package-owned agent workspace configuration
Mechanism
Creates guarded Cursor SDK workspace hooks
AI rationale
The scanner's cloud-metadata and child-process signals are bundled google-auth-library behavior, not first-party malicious flow. Runtime creation of first-party Cursor hooks is a guarded extension lifecycle risk, warranting a warning rather than a block.
Evidence
package.jsondist/esm/server.mjs.map~/.claude-code-router/cursor-sdk-workspaces/<session>/.cursor/hooks/deny-builtin.cjs~/.claude-code-router/cursor-sdk-workspaces/<session>/.cursor/hooks.json~/.claude-code-router/cursor-sdk-workspaces/<session>/AGENTS.md
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/esm/server.mjs.map: cursor transformer creates a Cursor agent on runtime request.
- It writes executable deny-builtin.cjs plus .cursor/hooks.json and AGENTS.md in a package-owned workspace.
- Source map includes bundled google-auth-library metadata and child-process code.
Evidence against
- package.json has no preinstall, install, or postinstall scripts.
- Hook writes are limited to ~/.claude-code-router/cursor-sdk-workspaces/<session>, not the caller project.
- No first-party credential or command-output exfiltration flow was found.
- Metadata and child-process matches originate in bundled Google auth dependency code.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggeddist/esm/server.mjsView file
7`:case"\u2028":case"\u2029":return H(),"";case"\r":return H(),wr()===`
L8: `&&H(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw Be(H());case void 0:throw Be(H())}return H()}function Sw(){let t="",e=wr();if(!Ge.isHexDigit...
L9: `+s;w=v.join(T),k=`{
...
L13: `+s+w+`,
L14: `+b+"]"}return o.pop(),s=b,v}}});var Ac=J((gO,np)=>{var Dw=ep(),vw=rp(),Rw={parse:Dw,stringify:vw};np.exports=Rw});var Ap=J((fF,Qw)=>{Qw.exports={"0":"\u2080","1":"\u2081","2":"\u2...
L15: `)||n,code:s,status:o},e.data.error)}return Object.assign({message:n,code:s,status:o},e.data.error)}}return{message:n,code:e.status,status:e.statusText}}};Dt.GaxiosError=Nc;functio...
L16: `).join(`
...
L49: `+_+"}":"{"+b.join(",")+"}",n=_,A}}typeof Tm.stringify!="function"&&(Tm.stringify=function(f
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/esm/server.mjsView on unpkg · L760${A}
L61: `+await t.crypto.sha256DigestHex(y),_=await XT(t.crypto,t.securityCredentials.secretAccessKey,a,t.region,n),b=await ls(t.crypto,_,g),m=`${E_} Credential=${t.securityCredentials.acc...
L62: To learn more about authentication and Google APIs, visit:
High
Child Process
Package source references child process execution.
dist/esm/server.mjsView on unpkg · L60Findings
2 Critical4 High3 Medium3 Low
CriticalCredential Exfiltrationdist/esm/server.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cjs/server.cjs
HighChild Processdist/esm/server.mjs
HighSame File Env Network Executiondist/esm/server.mjs
HighCommand Output Exfiltrationdist/esm/server.mjs
HighCloud Metadata Accessdist/esm/server.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @caeliq/llms@1.0.56.
See all versions of @caeliq/llms for other recorded verdicts.
- Review the evidence and your use of @caeliq/llms@1.0.56 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.