registry / @caeliq/llms / 1.0.59
@caeliq/llms@1.0.59
A universal LLM API transformation server
AI Security Review
scanned 3mo ago · by lpm-firewall-aiNo lifecycle execution or covert exfiltration was found, so blocking as malware is not supported. The runtime workspace hook/rules installation is a concrete guarded agent-extension risk that warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting/configuring the Cursor SDK transformer in bridge or agent mode.
Impact
Can alter Cursor tool permissions and agent instructions for the selected workspace.
Mechanism
Creates Cursor deny hooks and workspace agent rules.
AI rationale
No lifecycle execution or covert exfiltration was found, so blocking as malware is not supported. The runtime workspace hook/rules installation is a concrete guarded agent-extension risk that warrants a warning.
Evidence
package.jsondist/esm/server.mjsdist/esm/server.mjs.mapdist/cursor-sdk/runner.d.tsREADME.mdworkspace/.cursor/hooks/deny-builtin.cjsworkspace/.cursor/hooks.jsonworkspace/AGENTS.md~/.claude-code-router/codex_auth.json~/.claude-code-router/qwen_auth.json~/.claude-code-router/claude_auth.json
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime Cursor SDK bridge writes workspace .cursor hook files and AGENTS.md.
- Those hooks execute a generated Node deny script before Cursor tool actions.
- Writes are reachable in configured Cursor bridge/agent operation, not at installation.
Evidence against
- package.json has no preinstall, install, or postinstall scripts.
- OAuth token reads/writes are documented, scoped to ~/.claude-code-router, and use mode 0600.
- Network calls route configured LLM/OAuth providers; no covert credential-exfiltration endpoint was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/esm/server.mjsView file
36`:case"\u2028":case"\u2029":return V(),"";case"\r":return V(),Mn()===`
L37: `&&V(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw qe(V());case void 0:throw qe(V())}return V()}function eR(){let t="",e=Mn();if(!et.isHexDigit...
L38: `+s;T=v.join(x),A=`{
...
L42: `+s+T+`,
L43: `+w+"]"}return o.pop(),s=w,v}}});var Ef=J(($q,O0)=>{var rR=R0(),oR=D0(),sR={parse:rR,stringify:oR};O0.exports=sR});var Bb=J((v$,Px)=>{Px.exports={"0":"\u2080","1":"\u2081","2":"\u2...
L44: `)||r,code:s,status:o},e.data.error)}return Object.assign({message:r,code:s,status:o},e.data.error)}}return{message:r,code:e.status,status:e.statusText}}};Ot.GaxiosError=ep;functio...
L45: `).join(`
...
L78: `+y+"}":"{"+w.join(",")+"}",r=y,_}}typeof mk.stringify!="function"&&(mk.stringify=functio
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/esm/server.mjsView on unpkg · L3689${_}
L90: `+await t.crypto.sha256DigestHex(h),y=await gF(t.crypto,t.securityCredentials.secretAccessKey,i,t.region,r),w=await xi(t.crypto,y,b),C=`${aE} Credential=${t.securityCredentials.acc...
L91: To learn more about authentication and Google APIs, visit:
High
Child Process
Package source references child process execution.
dist/esm/server.mjsView on unpkg · L89Findings
2 Critical6 High4 Medium3 Low
CriticalCredential Exfiltrationdist/esm/server.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cjs/server.cjs
HighChild Processdist/esm/server.mjs
HighSame File Env Network Executiondist/esm/server.mjs
HighCommand Output Exfiltrationdist/esm/server.mjs
HighCloud Metadata Accessdist/esm/server.mjs
HighTrigger Reachable Credential Exfiltrationdist/cjs/server.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cjs/server.cjs
MediumDynamic Requiredist/cjs/server.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @caeliq/llms@1.0.59.
See all versions of @caeliq/llms for other recorded verdicts.
- Review the evidence and your use of @caeliq/llms@1.0.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.