registry / @caeliq/llms / 1.0.61
@caeliq/llms@1.0.61
A universal LLM API transformation server
AI Security Review
scanned 3mo ago · by lpm-firewall-aiScanner matches arise from a bundled LLM gateway and its dependencies. Direct inspection found no lifecycle execution or concrete malicious chain; the agent-related writes are explicit runtime bridge setup in a managed workspace.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user configures and invokes the Cursor SDK bridge through the exported server.
Impact
Configured providers receive routed requests and credentials needed for their selected authentication flow; no unconsented install/import behavior was found.
Mechanism
Configured LLM request routing and optional managed-workspace Cursor bridge.
AI rationale
Scanner matches arise from a bundled LLM gateway and its dependencies. Direct inspection found no lifecycle execution or concrete malicious chain; the agent-related writes are explicit runtime bridge setup in a managed workspace.
Evidence
package.jsondist/cjs/server.cjsREADME.mdworkspaceDir/.cursor/hooks/deny-builtin.cjsworkspaceDir/.cursor/hooks.jsonworkspaceDir/AGENTS.md
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The optional Cursor SDK bridge writes executable deny hooks and a workspace AGENTS.md.
Evidence against
- package.json has no lifecycle scripts.
- Entrypoint exports server APIs; it does not start a server on import.
- Hook creation is limited to the Cursor bridge workspace and denies built-in tools.
- Network and environment references implement the documented, configured LLM-provider gateway and OAuth flows.
- No evidence of credential harvesting, unrelated exfiltration, remote payload loading, or install-time mutation was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/esm/server.mjsView file
1var XR=Object.create;var Sp=Object.defineProperty;var QR=Object.getOwnPropertyDescriptor;var ZR=Object.getOwnPropertyNames;var eD=Object.getPrototypeOf,tD=Object.prototype.hasOwnPr...
L2: -- Key to operate on
...
L58: `:case"\u2028":case"\u2029":return Y(),"";case"\r":return Y(),ir()===`
L59: `&&Y(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw He(Y());case void 0:throw He(Y())}return Y()}function gO(){let t="",e=ir();if(!rt.isHexDigit...
L60: `+s;E=A.join(x),w=`{
...
L64: `+s+E+`,
L65: `+k+"]"}return o.pop(),s=k,A}}});var Yp=G((lH,BC)=>{var _O=FC(),bO=MC(),CO={parse:_O,stringify:bO};BC.exports=CO});var hk=G((k3,I1)=>{I1.exports={"0":"\u2080","1":"\u2081","2":"\u2...
L66: `)||r,code:s,status:o},e.data.error)}return Object.assign({message:r,code:s,stat
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/esm/server.mjsView on unpkg · L1111${g}
L112: `+await t.crypto.sha256DigestHex(h),_=await Rj(t.crypto,t.securityCredentials.secretAccessKey,i,t.region,r),k=await ka(t.crypto,_,C),b=`${Kv} Credential=${t.securityCredentials.acc...
L113: To learn more about authentication and Google APIs, visit:
High
Child Process
Package source references child process execution.
dist/esm/server.mjsView on unpkg · L111Findings
2 Critical6 High4 Medium3 Low
CriticalCredential Exfiltrationdist/esm/server.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cjs/server.cjs
HighChild Processdist/esm/server.mjs
HighSame File Env Network Executiondist/esm/server.mjs
HighCommand Output Exfiltrationdist/esm/server.mjs
HighCloud Metadata Accessdist/esm/server.mjs
HighTrigger Reachable Credential Exfiltrationdist/cjs/server.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cjs/server.cjs
MediumDynamic Requiredist/cjs/server.cjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Affected versions and remediation
This report applies to @caeliq/llms@1.0.61.
See all versions of @caeliq/llms for other recorded verdicts.
- Review the evidence and your use of @caeliq/llms@1.0.61 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.