registry / @caeliq/llms / 1.0.65
@caeliq/llms@1.0.65
A universal LLM API transformation server
AI Security Review
scanned 26d ago · by lpm-firewall-aiThe bundle contains a real Cursor agent configuration capability, but the available source points to bridge integration and guarded workspace updates rather than a confirmed attack. Treat this as a warning about agent extension lifecycle risk, not a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Use of the exported server's bridge integration when workspace guidance changes.
Impact
Cursor tool hooks and workspace instructions can be changed; no external credential recipient or confirmed attack behavior was established.
Mechanism
The bundle creates `.cursor/hooks/deny-builtin.cjs`, writes `hooks.json`, and updates workspace guidance files.
AI rationale
The bundle contains a real Cursor agent configuration capability, but the available source points to bridge integration and guarded workspace updates rather than a confirmed attack. Treat this as a warning about agent extension lifecycle risk, not a publish block.
Evidence
dist/cjs/server.cjsdist/esm/server.mjs.cursor/hooks/deny-builtin.cjs.cursor/hooks/hooks.jsonAGENTS.md
Decision evidence
public snapshotAI called this Suspicious at 76.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package exports the CJS and ESM server bundles as its entrypoints.
- Both bundles contain code that creates `.cursor/hooks` and writes `deny-builtin.cjs` and Cursor hook configuration.
- The CJS bundle limits workspace guidance updates to bridge mode when its fingerprint changes.
Evidence against
- The manifest contains no install lifecycle script; the hook setup is code within the exported server bundles.
- The inspected setup creates Cursor hook files for the package's bridge integration; no credential collection or external transfer is established by these excerpts.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
10 flaggeddist/esm/server.mjsView file
1var cD=Object.create;var Pp=Object.defineProperty;var uD=Object.getOwnPropertyDescriptor;var lD=Object.getOwnPropertyNames;var dD=Object.getPrototypeOf,fD=Object.prototype.hasOwnPr...
L2: -- Key to operate on
...
L58: `:case"\u2028":case"\u2029":return Y(),"";case"\r":return Y(),ir()===`
L59: `&&Y(),"";case"1":case"2":case"3":case"4":case"5":case"6":case"7":case"8":case"9":throw He(Y());case void 0:throw He(Y())}return Y()}function vO(){let t="",e=ir();if(!rt.isHexDigit...
L60: `+s;E=A.join(x),k=`{
...
L64: `+s+E+`,
L65: `+w+"]"}return o.pop(),s=w,A}}});var sh=G((FH,KC)=>{var RO=WC(),DO=JC(),OO={parse:RO,stringify:DO};KC.exports=OO});var Tk=G((Y3,G1)=>{G1.exports={"0":"\u2080","1":"\u2081","2":"\u2...
L66: `)||r,code:s,status:o},e.data.error)}return Object.assign({message:r,code:s,stat
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/esm/server.mjsView on unpkg · L1111${g}
L112: `+await t.crypto.sha256DigestHex(h),m=await qU(t.crypto,t.securityCredentials.secretAccessKey,i,t.region,r),w=await Aa(t.crypto,m,b),C=`${aT} Credential=${t.securityCredentials.acc...
L113: To learn more about authentication and Google APIs, visit:
High
Child Process
Package source references child process execution.
dist/esm/server.mjsView on unpkg · L111Findings
3 Critical7 High4 Medium3 Low
CriticalCredential Exfiltrationdist/esm/server.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/cjs/server.cjs
CriticalPrevious Version Dangerous Deltadist/cjs/server.cjs
HighChild Processdist/esm/server.mjs
HighShell
HighSame File Env Network Executiondist/esm/server.mjs
HighCommand Output Exfiltrationdist/esm/server.mjs
HighCloud Metadata Accessdist/esm/server.mjs
HighTrigger Reachable Credential Exfiltrationdist/cjs/server.cjs
HighTrigger Reachable Command Output Exfiltrationdist/cjs/server.cjs
MediumDynamic Requiredist/cjs/server.cjs
Medium
Affected versions and remediation
This report applies to @caeliq/llms@1.0.65.
See all versions of @caeliq/llms for other recorded verdicts.
- Review the evidence and your use of @caeliq/llms@1.0.65 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.