registry / @caeliq/llms / 1.0.64
@caeliq/llms@1.0.64
A universal LLM API transformation server
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe published entrypoints expose a package-owned Cursor bridge that writes hooks and workspace guidance when bridge state changes. Its sandbox path requires opt-in, and the inspected behavior does not establish an unconsented foreign-agent control-surface attack or credential exfiltration; warn for the guarded agent integration capability.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Cursor bridge mode refreshes its guidance fingerprint.
Impact
The files can affect Cursor tool, shell, file-read, and MCP actions in that workspace.
Mechanism
The server writes hook configuration and a hook script under .cursor, plus AGENTS.md in the workspace; sandbox activation requires an explicit setting and is disabled in detected containers.
AI rationale
The published entrypoints expose a package-owned Cursor bridge that writes hooks and workspace guidance when bridge state changes. Its sandbox path requires opt-in, and the inspected behavior does not establish an unconsented foreign-agent control-surface attack or credential exfiltration; warn for the guarded agent integration capability.
Evidence
package.jsondist/cjs/server.cjsdist/esm/server.mjs.cursor/hooks/deny-builtin.cjs.cursor/hooks.jsonAGENTS.md
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Both package entrypoints load the reviewed server bundles.
- The bundles create Cursor hook files and write workspace guidance.
- The CJS caller refreshes these files when bridge mode guidance changes.
Evidence against
- The sandbox setting requires explicit opt-in and is disabled in detected containers.
- The reviewed behavior is package-owned Cursor bridge setup; no credential forwarding or unconsented foreign-agent mutation was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flaggeddist/esm/server.mjsView file
1var oD=Object.create;var Op=Object.defineProperty;var sD=Object.getOwnPropertyDescriptor;var iD=Object.getOwnPropertyNames;var aD=Object.getPrototypeOf,cD=Object.prototype.hasOwnPr...
L2: -- Key to operate on
...
L58: `:case"\u2028":case"\u2029":return Y(),"";case"\r":return Y(),ir()===`
L59: `&&Y(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw He(Y());case void 0:throw He(Y())}return Y()}function kO(){let t="",e=ir();if(!rt.isHexDigit...
L60: `+s;E=S.join(x),k=`{
...
L64: `+s+E+`,
L65: `+w+"]"}return o.pop(),s=w,S}}});var oh=G((xH,GC)=>{var EO=HC(),vO=WC(),TO={parse:EO,stringify:vO};GC.exports=TO});var Sk=G((H3,L1)=>{L1.exports={"0":"\u2080","1":"\u2081","2":"\u2...
L66: `)||r,code:s,status:o},e.data.error)}return Object.assign({message:r,code:s,stat
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/esm/server.mjsView on unpkg · L1111${g}
L112: `+await t.crypto.sha256DigestHex(h),m=await Mj(t.crypto,t.securityCredentials.secretAccessKey,i,t.region,r),w=await Sa(t.crypto,m,b),C=`${rT} Credential=${t.securityCredentials.acc...
L113: To learn more about authentication and Google APIs, visit:
High
Child Process
Package source references child process execution.
dist/esm/server.mjsView on unpkg · L111Findings
3 Critical7 High4 Medium3 Low
CriticalCredential Exfiltrationdist/esm/server.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cjs/server.cjs
CriticalPrevious Version Dangerous Deltadist/cjs/server.cjs
HighChild Processdist/esm/server.mjs
HighShell
HighSame File Env Network Executiondist/esm/server.mjs
HighCommand Output Exfiltrationdist/esm/server.mjs
HighCloud Metadata Accessdist/esm/server.mjs
HighTrigger Reachable Credential Exfiltrationdist/cjs/server.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cjs/server.cjs
MediumDynamic Requiredist/cjs/server.cjs
Medium
Affected versions and remediation
This report applies to @caeliq/llms@1.0.64.
See all versions of @caeliq/llms for other recorded verdicts.
- Review the evidence and your use of @caeliq/llms@1.0.64 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.